Edit tour

Windows Analysis Report
PROFORMA FATURA pdf.exe

Overview

General Information

Sample name:	PROFORMA FATURA pdf.exe
Analysis ID:	1545969
MD5:	1a74c66d4750248af37fe8cb959560cd
SHA1:	8d4de0fd49e567ed59ff6e0efb62ff43de76e841
SHA256:	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413
Tags:	exeuser-lowmal3
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected Snake Keylogger

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Drops VBS files to the startup folder

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PROFORMA FATURA pdf.exe (PID: 5312 cmdline: "C:\Users\user\Desktop\PROFORMA FATURA pdf.exe" MD5: 1A74C66D4750248AF37FE8CB959560CD)

MSBuild.exe (PID: 2004 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" MD5: 2EDD0B288FE2459DA84E4274D1942343)

wscript.exe (PID: 4432 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

ApplicationUrl.exe (PID: 2008 cmdline: "C:\Users\user\AppData\Roaming\ApplicationUrl.exe" MD5: 1A74C66D4750248AF37FE8CB959560CD)

MSBuild.exe (PID: 4912 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" MD5: 2EDD0B288FE2459DA84E4274D1942343)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7924534953:AAE4uZnxj0ai2Cq4ObwL8XXynOA1iDROON0/sendMessage?chat_id=7969902771", "Token": "7924534953:AAE4uZnxj0ai2Cq4ObwL8XXynOA1iDROON0", "Chat_id": "7969902771", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14f22:$a1: get_encryptedPassword 0x1520e:$a2: get_encryptedUsername 0x14d2e:$a3: get_timePasswordChanged 0x14e29:$a4: get_passwordField 0x14f38:$a5: set_encryptedPassword 0x16548:$a7: get_logins 0x164ab:$a10: KeyLoggerEventArgs 0x16144:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19ec0:$x1: $%SMTPDV$ 0x188a4:$x2: $#TheHashHere%& 0x19e68:$x3: %FTPDV$ 0x18844:$x4: $%TelegramDv$ 0x16144:$x5: KeyLoggerEventArgs 0x164ab:$x5: KeyLoggerEventArgs 0x19e8c:$m2: Clipboard Logs ID 0x1a0ca:$m2: Screenshot Logs ID 0x1a1da:$m2: keystroke Logs ID 0x1a4b4:$m3: SnakePW 0x1a0a2:$m4: \SnakeKeylogger\
00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x18392:$a1: get_encryptedPassword 0x1867e:$a2: get_encryptedUsername 0x1819e:$a3: get_timePasswordChanged 0x18299:$a4: get_passwordField 0x183a8:$a5: set_encryptedPassword 0x199b8:$a7: get_logins 0x1991b:$a10: KeyLoggerEventArgs 0x195b4:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1d330:$x1: $%SMTPDV$ 0x1bd14:$x2: $#TheHashHere%& 0x1d2d8:$x3: %FTPDV$ 0x1bcb4:$x4: $%TelegramDv$ 0x195b4:$x5: KeyLoggerEventArgs 0x1991b:$x5: KeyLoggerEventArgs 0x1d2fc:$m2: Clipboard Logs ID 0x1d53a:$m2: Screenshot Logs ID 0x1d64a:$m2: keystroke Logs ID 0x1d924:$m3: SnakePW 0x1d512:$m4: \SnakeKeylogger\
00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19710:$x1: $%SMTPDV$ 0x196b8:$x3: %FTPDV$ 0x196dc:$m2: Clipboard Logs ID 0x1991a:$m2: Screenshot Logs ID 0x19a2a:$m2: keystroke Logs ID 0x19d04:$m3: SnakePW 0x198f2:$m4: \SnakeKeylogger\
00000000.00000002.1546995097.00000259A5440000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x471a:$a1: get_encryptedPassword 0x4a06:$a2: get_encryptedUsername 0x4526:$a3: get_timePasswordChanged 0x4621:$a4: get_passwordField 0x4730:$a5: set_encryptedPassword 0x5d40:$a7: get_logins 0x5ca3:$a10: KeyLoggerEventArgs 0x593c:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x96b8:$x1: $%SMTPDV$ 0x809c:$x2: $#TheHashHere%& 0x9660:$x3: %FTPDV$ 0x803c:$x4: $%TelegramDv$ 0x593c:$x5: KeyLoggerEventArgs 0x5ca3:$x5: KeyLoggerEventArgs 0x9684:$m2: Clipboard Logs ID 0x98c2:$m2: Screenshot Logs ID 0x99d2:$m2: keystroke Logs ID 0x9cac:$m3: SnakePW 0x989a:$m4: \SnakeKeylogger\
00000002.00000002.3993061592.000001F3C531C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x633ba:$a1: get_encryptedPassword 0x636a6:$a2: get_encryptedUsername 0x631c6:$a3: get_timePasswordChanged 0x632c1:$a4: get_passwordField 0x633d0:$a5: set_encryptedPassword 0x649e0:$a7: get_logins 0x64943:$a10: KeyLoggerEventArgs 0x645dc:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x68358:$x1: $%SMTPDV$ 0x66d3c:$x2: $#TheHashHere%& 0x68300:$x3: %FTPDV$ 0x66cdc:$x4: $%TelegramDv$ 0x645dc:$x5: KeyLoggerEventArgs 0x64943:$x5: KeyLoggerEventArgs 0x68324:$m2: Clipboard Logs ID 0x68562:$m2: Screenshot Logs ID 0x68672:$m2: keystroke Logs ID 0x6894c:$m3: SnakePW 0x6853a:$m4: \SnakeKeylogger\
00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x4164a:$a1: get_encryptedPassword 0x41936:$a2: get_encryptedUsername 0x41456:$a3: get_timePasswordChanged 0x41551:$a4: get_passwordField 0x41660:$a5: set_encryptedPassword 0x42c70:$a7: get_logins 0x42bd3:$a10: KeyLoggerEventArgs 0x4286c:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x465e8:$x1: $%SMTPDV$ 0x44fcc:$x2: $#TheHashHere%& 0x46590:$x3: %FTPDV$ 0x44f6c:$x4: $%TelegramDv$ 0x4286c:$x5: KeyLoggerEventArgs 0x42bd3:$x5: KeyLoggerEventArgs 0x465b4:$m2: Clipboard Logs ID 0x467f2:$m2: Screenshot Logs ID 0x46902:$m2: keystroke Logs ID 0x46bdc:$m3: SnakePW 0x467ca:$m4: \SnakeKeylogger\
00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.3988703094.000001FD00257000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.3993061592.000001F3C50D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.3988703094.000001FD00001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x11cb90:$x1: $%SMTPDV$ 0x11cb38:$x3: %FTPDV$ 0x11cb5c:$m2: Clipboard Logs ID 0x11cd9a:$m2: Screenshot Logs ID 0x11ceaa:$m2: keystroke Logs ID 0x11d184:$m3: SnakePW 0x11cd72:$m4: \SnakeKeylogger\
00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x154aa:$a1: get_encryptedPassword 0x15796:$a2: get_encryptedUsername 0x152b6:$a3: get_timePasswordChanged 0x153b1:$a4: get_passwordField 0x154c0:$a5: set_encryptedPassword 0x16ad0:$a7: get_logins 0x16a33:$a10: KeyLoggerEventArgs 0x166cc:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1a448:$x1: $%SMTPDV$ 0x18e2c:$x2: $#TheHashHere%& 0x1a3f0:$x3: %FTPDV$ 0x18dcc:$x4: $%TelegramDv$ 0x166cc:$x5: KeyLoggerEventArgs 0x16a33:$x5: KeyLoggerEventArgs 0x1a414:$m2: Clipboard Logs ID 0x1a652:$m2: Screenshot Logs ID 0x1a762:$m2: keystroke Logs ID 0x1aa3c:$m3: SnakePW 0x1a62a:$m4: \SnakeKeylogger\
Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa1d3:$a1: get_encryptedPassword 0x656b6:$a1: get_encryptedPassword 0xa4b5:$a2: get_encryptedUsername 0x65998:$a2: get_encryptedUsername 0x9fe9:$a3: get_timePasswordChanged 0x654cc:$a3: get_timePasswordChanged 0xa0e4:$a4: get_passwordField 0x655c7:$a4: get_passwordField 0xa1e9:$a5: set_encryptedPassword 0x656cc:$a5: set_encryptedPassword 0xc5fe:$a7: get_logins 0x67ae1:$a7: get_logins 0xc561:$a10: KeyLoggerEventArgs 0x67a44:$a10: KeyLoggerEventArgs 0xc1fa:$a11: KeyLoggerEventArgsEventHandler 0x676dd:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xc1fa:$x5: KeyLoggerEventArgs 0xc561:$x5: KeyLoggerEventArgs 0xce4f:$x5: KeyLoggerEventArgs 0xd183:$x5: KeyLoggerEventArgs 0x676dd:$x5: KeyLoggerEventArgs 0x67a44:$x5: KeyLoggerEventArgs 0x68332:$x5: KeyLoggerEventArgs 0x68666:$x5: KeyLoggerEventArgs 0xe710:$m2: Clipboard Logs ID 0xe816:$m2: Screenshot Logs ID 0xe86c:$m2: keystroke Logs ID 0x69bf3:$m2: Clipboard Logs ID 0x69cf9:$m2: Screenshot Logs ID 0x69d4f:$m2: keystroke Logs ID 0xd5915:$m2: Clipboard Logs ID 0xd5a1b:$m2: Screenshot Logs ID 0xd5a71:$m2: keystroke Logs ID 0xe9a1:$m3: SnakePW 0x69e84:$m3: SnakePW 0xd5ba6:$m3: SnakePW 0xe802:$m4: \SnakeKeylogger\
Process Memory Space: MSBuild.exe PID: 2004	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 2004	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: ApplicationUrl.exe PID: 2008	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: ApplicationUrl.exe PID: 2008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ApplicationUrl.exe PID: 2008	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: ApplicationUrl.exe PID: 2008	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x51d1:$a1: get_encryptedPassword 0x7ff27:$a1: get_encryptedPassword 0xaf8a2:$a1: get_encryptedPassword 0x54b3:$a2: get_encryptedUsername 0x800f6:$a2: get_encryptedUsername 0xafb84:$a2: get_encryptedUsername 0x4fe7:$a3: get_timePasswordChanged 0x7fd50:$a3: get_timePasswordChanged 0xaf6b8:$a3: get_timePasswordChanged 0x50e2:$a4: get_passwordField 0x7fe3f:$a4: get_passwordField 0xaf7b3:$a4: get_passwordField 0x51e7:$a5: set_encryptedPassword 0x7ff3d:$a5: set_encryptedPassword 0xaf8b8:$a5: set_encryptedPassword 0x75fc:$a7: get_logins 0x81c72:$a7: get_logins 0xb1cc7:$a7: get_logins 0x755f:$a10: KeyLoggerEventArgs 0x81bdf:$a10: KeyLoggerEventArgs 0xb1c2a:$a10: KeyLoggerEventArgs
Process Memory Space: ApplicationUrl.exe PID: 2008	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x71f8:$x5: KeyLoggerEventArgs 0x755f:$x5: KeyLoggerEventArgs 0x7e4d:$x5: KeyLoggerEventArgs 0x8181:$x5: KeyLoggerEventArgs 0x81936:$x5: KeyLoggerEventArgs 0x81bdf:$x5: KeyLoggerEventArgs 0x82357:$x5: KeyLoggerEventArgs 0x8268b:$x5: KeyLoggerEventArgs 0xb18c9:$x5: KeyLoggerEventArgs 0xb1c2a:$x5: KeyLoggerEventArgs 0xb2518:$x5: KeyLoggerEventArgs 0xb284c:$x5: KeyLoggerEventArgs 0x970e:$m2: Clipboard Logs ID 0x9814:$m2: Screenshot Logs ID 0x986a:$m2: keystroke Logs ID 0x13f10:$m2: Clipboard Logs ID 0x14016:$m2: Screenshot Logs ID 0x1406c:$m2: keystroke Logs ID 0x83b78:$m2: Clipboard Logs ID 0x83c7e:$m2: Screenshot Logs ID 0x83cd4:$m2: keystroke Logs ID
Process Memory Space: MSBuild.exe PID: 4912	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 4912	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: MSBuild.exe PID: 4912	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x4855a:$a1: get_encryptedPassword 0x4883c:$a2: get_encryptedUsername 0x48370:$a3: get_timePasswordChanged 0x4846b:$a4: get_passwordField 0x48570:$a5: set_encryptedPassword 0x4a985:$a7: get_logins 0x4a8e8:$a10: KeyLoggerEventArgs 0x4a581:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: MSBuild.exe PID: 4912	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4a581:$x5: KeyLoggerEventArgs 0x4a8e8:$x5: KeyLoggerEventArgs 0x4b1d6:$x5: KeyLoggerEventArgs 0x4b50a:$x5: KeyLoggerEventArgs 0x4ca97:$m2: Clipboard Logs ID 0x4cb9d:$m2: Screenshot Logs ID 0x4cbf3:$m2: keystroke Logs ID 0x4cd28:$m3: SnakePW 0x4cb89:$m4: \SnakeKeylogger\
Click to see the 48 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.PROFORMA FATURA pdf.exe.259a5440000.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PROFORMA FATURA pdf.exe.259b6d4bd50.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.ApplicationUrl.exe.288353c6aa0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.ApplicationUrl.exe.288353c6aa0.5.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
4.2.ApplicationUrl.exe.288353c6aa0.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12b1a:$a1: get_encryptedPassword 0x12e06:$a2: get_encryptedUsername 0x12926:$a3: get_timePasswordChanged 0x12a21:$a4: get_passwordField 0x12b30:$a5: set_encryptedPassword 0x14140:$a7: get_logins 0x140a3:$a10: KeyLoggerEventArgs 0x13d3c:$a11: KeyLoggerEventArgsEventHandler
4.2.ApplicationUrl.exe.288353c6aa0.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a46e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x196a0:$a3: \Google\Chrome\User Data\Default\Login Data 0x19ad3:$a4: \Orbitum\User Data\Default\Login Data 0x1ab12:$a5: \Kometa\User Data\Default\Login Data
4.2.ApplicationUrl.exe.288353c6aa0.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x136bb:$s1: UnHook 0x136c2:$s2: SetHook 0x136ca:$s3: CallNextHook 0x136d7:$s4: _hook
4.2.ApplicationUrl.exe.288353c6aa0.5.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17ab8:$x1: $%SMTPDV$ 0x1649c:$x2: $#TheHashHere%& 0x17a60:$x3: %FTPDV$ 0x1643c:$x4: $%TelegramDv$ 0x13d3c:$x5: KeyLoggerEventArgs 0x140a3:$x5: KeyLoggerEventArgs 0x17a84:$m2: Clipboard Logs ID 0x17cc2:$m2: Screenshot Logs ID 0x17dd2:$m2: keystroke Logs ID 0x180ac:$m3: SnakePW 0x17c9a:$m4: \SnakeKeylogger\
4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1491a:$a1: get_encryptedPassword 0x14c06:$a2: get_encryptedUsername 0x14726:$a3: get_timePasswordChanged 0x14821:$a4: get_passwordField 0x14930:$a5: set_encryptedPassword 0x15f40:$a7: get_logins 0x15ea3:$a10: KeyLoggerEventArgs 0x15b3c:$a11: KeyLoggerEventArgsEventHandler
4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c26e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b4a0:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b8d3:$a4: \Orbitum\User Data\Default\Login Data 0x1c912:$a5: \Kometa\User Data\Default\Login Data
4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x154bb:$s1: UnHook 0x154c2:$s2: SetHook 0x154ca:$s3: CallNextHook 0x154d7:$s4: _hook
4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x198b8:$x1: $%SMTPDV$ 0x1829c:$x2: $#TheHashHere%& 0x19860:$x3: %FTPDV$ 0x1823c:$x4: $%TelegramDv$ 0x15b3c:$x5: KeyLoggerEventArgs 0x15ea3:$x5: KeyLoggerEventArgs 0x19884:$m2: Clipboard Logs ID 0x19ac2:$m2: Screenshot Logs ID 0x19bd2:$m2: keystroke Logs ID 0x19eac:$m3: SnakePW 0x19a9a:$m4: \SnakeKeylogger\
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12b1a:$a1: get_encryptedPassword 0x12e06:$a2: get_encryptedUsername 0x12926:$a3: get_timePasswordChanged 0x12a21:$a4: get_passwordField 0x12b30:$a5: set_encryptedPassword 0x14140:$a7: get_logins 0x140a3:$a10: KeyLoggerEventArgs 0x13d3c:$a11: KeyLoggerEventArgsEventHandler
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a46e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x196a0:$a3: \Google\Chrome\User Data\Default\Login Data 0x19ad3:$a4: \Orbitum\User Data\Default\Login Data 0x1ab12:$a5: \Kometa\User Data\Default\Login Data
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x136bb:$s1: UnHook 0x136c2:$s2: SetHook 0x136ca:$s3: CallNextHook 0x136d7:$s4: _hook
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17ab8:$x1: $%SMTPDV$ 0x1649c:$x2: $#TheHashHere%& 0x17a60:$x3: %FTPDV$ 0x1643c:$x4: $%TelegramDv$ 0x13d3c:$x5: KeyLoggerEventArgs 0x140a3:$x5: KeyLoggerEventArgs 0x17a84:$m2: Clipboard Logs ID 0x17cc2:$m2: Screenshot Logs ID 0x17dd2:$m2: keystroke Logs ID 0x180ac:$m3: SnakePW 0x17c9a:$m4: \SnakeKeylogger\
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1491a:$a1: get_encryptedPassword 0x14c06:$a2: get_encryptedUsername 0x14726:$a3: get_timePasswordChanged 0x14821:$a4: get_passwordField 0x14930:$a5: set_encryptedPassword 0x15f40:$a7: get_logins 0x15ea3:$a10: KeyLoggerEventArgs 0x15b3c:$a11: KeyLoggerEventArgsEventHandler
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c26e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b4a0:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b8d3:$a4: \Orbitum\User Data\Default\Login Data 0x1c912:$a5: \Kometa\User Data\Default\Login Data
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x154bb:$s1: UnHook 0x154c2:$s2: SetHook 0x154ca:$s3: CallNextHook 0x154d7:$s4: _hook
0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x198b8:$x1: $%SMTPDV$ 0x1829c:$x2: $#TheHashHere%& 0x19860:$x3: %FTPDV$ 0x1823c:$x4: $%TelegramDv$ 0x15b3c:$x5: KeyLoggerEventArgs 0x15ea3:$x5: KeyLoggerEventArgs 0x19884:$m2: Clipboard Logs ID 0x19ac2:$m2: Screenshot Logs ID 0x19bd2:$m2: keystroke Logs ID 0x19eac:$m3: SnakePW 0x19a9a:$m4: \SnakeKeylogger\
4.2.ApplicationUrl.exe.28835378268.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.ApplicationUrl.exe.28835378268.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.ApplicationUrl.exe.28835378268.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
4.2.ApplicationUrl.exe.28835378268.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x63152:$a1: get_encryptedPassword 0x6343e:$a2: get_encryptedUsername 0x62f5e:$a3: get_timePasswordChanged 0x63059:$a4: get_passwordField 0x63168:$a5: set_encryptedPassword 0x64778:$a7: get_logins 0x646db:$a10: KeyLoggerEventArgs 0x64374:$a11: KeyLoggerEventArgsEventHandler
4.2.ApplicationUrl.exe.28835378268.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x6aaa6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x69cd8:$a3: \Google\Chrome\User Data\Default\Login Data 0x6a10b:$a4: \Orbitum\User Data\Default\Login Data 0x6b14a:$a5: \Kometa\User Data\Default\Login Data
4.2.ApplicationUrl.exe.28835378268.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x63cf3:$s1: UnHook 0x63cfa:$s2: SetHook 0x63d02:$s3: CallNextHook 0x63d0f:$s4: _hook
4.2.ApplicationUrl.exe.28835378268.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x680f0:$x1: $%SMTPDV$ 0x66ad4:$x2: $#TheHashHere%& 0x68098:$x3: %FTPDV$ 0x66a74:$x4: $%TelegramDv$ 0x64374:$x5: KeyLoggerEventArgs 0x646db:$x5: KeyLoggerEventArgs 0x680bc:$m2: Clipboard Logs ID 0x682fa:$m2: Screenshot Logs ID 0x6840a:$m2: keystroke Logs ID 0x686e4:$m3: SnakePW 0x682d2:$m4: \SnakeKeylogger\
Click to see the 28 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 193.122.6.168, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 2004, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49702

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs" , ProcessId: 4432, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs" , ProcessId: 4432, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe, ProcessId: 5312, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T10:58:58.303061+0100	2803305	3	Unknown Traffic	192.168.2.7	49704	188.114.97.3	443	TCP
2024-10-31T10:58:59.944346+0100	2803305	3	Unknown Traffic	192.168.2.7	49706	188.114.97.3	443	TCP
2024-10-31T10:59:08.073351+0100	2803305	3	Unknown Traffic	192.168.2.7	49717	188.114.97.3	443	TCP
2024-10-31T10:59:09.499379+0100	2803305	3	Unknown Traffic	192.168.2.7	49720	188.114.97.3	443	TCP
2024-10-31T10:59:14.381416+0100	2803305	3	Unknown Traffic	192.168.2.7	49729	188.114.97.3	443	TCP
2024-10-31T10:59:16.001575+0100	2803305	3	Unknown Traffic	192.168.2.7	49731	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T10:58:55.619997+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49702	193.122.6.168	80	TCP
2024-10-31T10:58:57.575086+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49702	193.122.6.168	80	TCP
2024-10-31T10:58:59.198131+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49705	193.122.6.168	80	TCP
2024-10-31T10:59:07.682566+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49715	193.122.6.168	80	TCP
2024-10-31T10:59:08.776351+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49715	193.122.6.168	80	TCP
2024-10-31T10:59:10.401358+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49722	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7924534953:AAE4uZnxj0ai2Cq4ObwL8XXynOA1iDROON0/sendMessage?chat_id=7969902771", "Token": "7924534953:AAE4uZnxj0ai2Cq4ObwL8XXynOA1iDROON0", "Chat_id": "7969902771", "Version": "5.1"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe

ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: PROFORMA FATURA pdf.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PROFORMA FATURA pdf.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49703 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49718 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49913 version: TLS 1.2

Source: PROFORMA FATURA pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555732751.00000259BF590000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A71D7000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.000002882548F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555732751.00000259BF590000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A71D7000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.000002882548F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 00007FFAAC16A82Bh	2_2_00007FFAAC16A5FF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 00007FFAAC16AE45h	2_2_00007FFAAC16AACC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 00007FFAAC16AE45h	2_2_00007FFAAC16AD61
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4x nop then jmp 00007FFAAC19B776h	4_2_00007FFAAC19B56E
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4x nop then jmp 00007FFAAC3672DFh	4_2_00007FFAAC3672A7
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 00007FFAAC19A82Bh	5_2_00007FFAAC19A572
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 00007FFAAC19AE45h	5_2_00007FFAAC19AACC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 00007FFAAC19AE45h	5_2_00007FFAAC19AD61

Networking

Yara detected Generic Downloader

Source: Yara match

File source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ORACLE-BMC-31898US ORACLE-BMC-31898US

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49705 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49702 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49722 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49715 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49729 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49720 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49706 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49704 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49703 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49718 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: MSBuild.exe, 00000002.00000002.3991155326.000001F3C4E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndn
Source: MSBuild.exe, 00000002.00000002.3993061592.000001F3C5283000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5308000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5297000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C51DC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52AB000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52F5000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001E6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00243000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD0020E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: MSBuild.exe, 00000002.00000002.3993061592.000001F3C50D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3991155326.000001F3C4E20000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: MSBuild.exe, 00000002.00000002.3991155326.000001F3C4E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/v
Source: MSBuild.exe, 00000002.00000002.3991155326.000001F3C4E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/~
Source: MSBuild.exe, 00000002.00000002.3993061592.000001F3C5283000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5308000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C51FC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5297000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52AB000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52F5000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00137000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001E6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00243000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A71D7000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C50D1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.000002882548F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: MSBuild.exe, 00000002.00000002.3993061592.000001F3C5283000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5308000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5297000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C51DC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52AB000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52F5000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C522B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001E6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00166000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00243000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C51DC000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: MSBuild.exe, 00000005.00000002.3988703094.000001FD00230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.77
Source: MSBuild.exe, 00000002.00000002.3993061592.000001F3C51DC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.77p
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930

Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49913 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: ApplicationUrl.exe PID: 2008, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: ApplicationUrl.exe PID: 2008, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: MSBuild.exe PID: 4912, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MSBuild.exe PID: 4912, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe

Code function: 4_2_00007FFAAC36DEF2 NtQueryInformationProcess,

4_2_00007FFAAC36DEF2

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC1866F3	0_2_00007FFAAC1866F3
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC359107	0_2_00007FFAAC359107
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC352DB5	0_2_00007FFAAC352DB5
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC3555F9	0_2_00007FFAAC3555F9
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC355F78	0_2_00007FFAAC355F78
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC3523E4	0_2_00007FFAAC3523E4
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC359120	0_2_00007FFAAC359120
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC359190	0_2_00007FFAAC359190
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC356FFA	0_2_00007FFAAC356FFA
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC1E6520	4_2_00007FFAAC1E6520
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC1E6540	4_2_00007FFAAC1E6540
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC1EA831	4_2_00007FFAAC1EA831
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC1A1749	4_2_00007FFAAC1A1749
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC35B310	4_2_00007FFAAC35B310
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC35C1E0	4_2_00007FFAAC35C1E0
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC352DB5	4_2_00007FFAAC352DB5
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC355F78	4_2_00007FFAAC355F78
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC351979	4_2_00007FFAAC351979
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC3523E4	4_2_00007FFAAC3523E4
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC355669	4_2_00007FFAAC355669
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC35375D	4_2_00007FFAAC35375D
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC356FFA	4_2_00007FFAAC356FFA

Source: ApplicationUrl.exe.0.dr	Static PE information: No import functions for PE file found
Source: PROFORMA FATURA pdf.exe	Static PE information: No import functions for PE file found

Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefbXfjPLUOxpHounQOLpg.exeX vs PROFORMA FATURA pdf.exe
Source: PROFORMA FATURA pdf.exe, 00000000.00000000.1524692174.00000259A5000000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMxyuybboj.exe4 vs PROFORMA FATURA pdf.exe
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PROFORMA FATURA pdf.exe
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555732751.00000259BF590000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PROFORMA FATURA pdf.exe
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PROFORMA FATURA pdf.exe
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A71D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PROFORMA FATURA pdf.exe
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555005047.00000259BF430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExstzcbd.dll" vs PROFORMA FATURA pdf.exe
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefbXfjPLUOxpHounQOLpg.exeX vs PROFORMA FATURA pdf.exe
Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6E20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExstzcbd.dll" vs PROFORMA FATURA pdf.exe
Source: PROFORMA FATURA pdf.exe	Binary or memory string: OriginalFilenameMxyuybboj.exe4 vs PROFORMA FATURA pdf.exe

Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: ApplicationUrl.exe PID: 2008, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: ApplicationUrl.exe PID: 2008, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: MSBuild.exe PID: 4912, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MSBuild.exe PID: 4912, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: PROFORMA FATURA pdf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ApplicationUrl.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PROFORMA FATURA pdf.exe, ManagerTagTemplate.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, IvZDtxJ4N1mnnOf3G59.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, IvZDtxJ4N1mnnOf3G59.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, IvZDtxJ4N1mnnOf3G59.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, IvZDtxJ4N1mnnOf3G59.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@8/3@2/2

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Mutant created: NULL

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs"

Source: PROFORMA FATURA pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PROFORMA FATURA pdf.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000002.00000002.3993061592.000001F3C53AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C53FC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3999440751.000001F3D5166000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C53CD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C53BE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5409000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00343000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD002F8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00336000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3995988321.000001FD10096000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD002E9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PROFORMA FATURA pdf.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

File read: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe "C:\Users\user\Desktop\PROFORMA FATURA pdf.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\ApplicationUrl.exe "C:\Users\user\AppData\Roaming\ApplicationUrl.exe"
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\ApplicationUrl.exe "C:\Users\user\AppData\Roaming\ApplicationUrl.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PROFORMA FATURA pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PROFORMA FATURA pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555732751.00000259BF590000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A71D7000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.000002882548F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555732751.00000259BF590000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A71D7000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.000002882548F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, IvZDtxJ4N1mnnOf3G59.cs

.Net Code: Type.GetTypeFromHandle(AUHnVSk2VxTP01PXnyS.SD5QYPFXuH(16777347)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(AUHnVSk2VxTP01PXnyS.SD5QYPFXuH(16777252)),Type.GetTypeFromHandle(AUHnVSk2VxTP01PXnyS.SD5QYPFXuH(16777284))})

.NET source code contains potential unpacker

Source: PROFORMA FATURA pdf.exe, ManagerTagTemplate.cs	.Net Code: ListExporter System.Reflection.Assembly.Load(byte[])
Source: 0.2.PROFORMA FATURA pdf.exe.259b6dd05c0.2.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.PROFORMA FATURA pdf.exe.259b6dd05c0.2.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.PROFORMA FATURA pdf.exe.259b6dd05c0.2.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.PROFORMA FATURA pdf.exe.259b6dd05c0.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.PROFORMA FATURA pdf.exe.259b6dd05c0.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.PROFORMA FATURA pdf.exe.259bf590000.11.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.PROFORMA FATURA pdf.exe.259a5440000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA pdf.exe.259b6d4bd50.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1546995097.00000259A5440000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ApplicationUrl.exe PID: 2008, type: MEMORYSTR

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC18CC0F push es; retn 7002h	0_2_00007FFAAC18CCF1
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC18A515 push ebx; retn 0004h	0_2_00007FFAAC18A53A
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC18754D push ebx; iretd	0_2_00007FFAAC18756A
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC1886D3 pushad ; retf	0_2_00007FFAAC1886C1
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC1837F2 pushad ; ret	0_2_00007FFAAC183811
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC188167 push ebx; ret	0_2_00007FFAAC18816A
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Code function: 0_2_00007FFAAC185AF7 push FFFFFFE8h; ret	0_2_00007FFAAC185AF9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 2_2_00007FFAAC16A518 push eax; iretd	2_2_00007FFAAC16A519
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 2_2_00007FFAAC1616AD push eax; ret	2_2_00007FFAAC1616C4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 2_2_00007FFAAC161B97 push eax; ret	2_2_00007FFAAC161BA4
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC1837F2 pushad ; ret	4_2_00007FFAAC183811
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Code function: 4_2_00007FFAAC35DFDA push esp; iretd	4_2_00007FFAAC35DFDB
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 5_2_00007FFAAC19A518 push eax; iretd	5_2_00007FFAAC19A519
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 5_2_00007FFAAC1931CD push ebx; ret	5_2_00007FFAAC1931EA
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Code function: 5_2_00007FFAAC19324D push E95C9EDDh; ret	5_2_00007FFAAC193279

Source: PROFORMA FATURA pdf.exe	Static PE information: section name: .text entropy: 7.996595385701048
Source: ApplicationUrl.exe.0.dr	Static PE information: section name: .text entropy: 7.996595385701048

Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, IvZDtxJ4N1mnnOf3G59.cs	High entropy of concatenated method names: 'iip1JoU8QyyYovgr33v', 'P6fHHvUVwWowN3bMfbL', 'mxJkkQ3pt2', 'guFv07UAReHoYhBg9p3', 'B62yhEUhOmJWdQd8v29', 'uMfCiMUfQZ6UVT6F7e8', 'yZQ2bOUPFqBYreipwVV', 'wBJaajUSInBGlXlltBF', 'F89bSlUz3dBUCHrDf5w', 'coLxutMrghRQjXBfU5q'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'rsTu4hUknSyZrEeGF0F'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, iE8GMBkzEBV6rAMW7Fl.cs	High entropy of concatenated method names: 'w385xSNZ5w', 'JjR5aBpv8p', 'zJK59rJh11', 'rd45ehW074', 'csw5T2PuKF', 'NDk5cGSjqt', 'sSb5tXRad0', 'fm5Yn97BBG', 'zE15dEpPwa', 'jCg52Kvbau'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, naqVEtklVb9LVQLRENo.cs	High entropy of concatenated method names: 'XjUk82MRZC', 'J6DkVFZOwq', 'HCDkIZ7Vfl', 'G1wko1mWSV', 'T6vkZS3gv1', 'MohkAJQuGm', 'I5FkhW8NYR', 'LDGkfHWdF8', 'BiSkP1GvwS', 'nnbkSE8Y5i'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, jrWXGaLFuMV8UvPsote.cs	High entropy of concatenated method names: 'zBxLKJrdA2', 'z6NLY8HG7D', 'IHHLy40TKa', 'cVaL6BPPZC', 'SaqLpL8jaP', 'lTZL5Nw4AS', 'fMXLHkPBeP', 'eNBLgpBTwe', 'x0cLEFu46U', 'UKQLs6HdDJ'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, JBretCJpenxjZrEVeKV.cs	High entropy of concatenated method names: 'oSBJHX4ebA', 'kXyJgNUGlT', 'QOYVslBMLmVFdMeKbsr', 'gHR3LJBCijalwFZH4b3', 'qybqitBRaLaQAH5AWhl', 'sQPlB4Buhvryhtj1E4I', 'pWkKVNBDcknwjRGPSI6', 'LTg8btBQnrhHXXqTdhX', 'OmmI97BwIGe97fKHNpF'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, A39kvb1B4pakl11f7X8.cs	High entropy of concatenated method names: 'cFp1MN6SKr', 'CfD1CsGLUI', 'AFt1RQobAr', 'A3KdDRlc8iVSueJ4qu3', 'yYyk04ltm1B8J6DAjt7', 'gWfM2Mld2fstuYAZWTV', 'vv7aoel2rM76BasEw4M'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, AUHnVSk2VxTP01PXnyS.cs	High entropy of concatenated method names: 'SD5QYPFXuH', 'TPDQvcAGyT', 'CwjPZoMsVSICgW3akPk', 'BJRlwRMX6sb4Ok6e4tv', 'brZWJoMnqrQHuZwOHog', 'qvIo5wMxq8kpaAW2ts2', 'fsSe80MaIHCTue0dcJl', 'g6fc4cM9Kye71FCkqtU'
Source: 0.2.PROFORMA FATURA pdf.exe.259b6f22188.3.raw.unpack, JdRapi1238wElynVbP9.cs	High entropy of concatenated method names: 'oFg10SGNhi', 'KN31WrVNli', 'rCS14hhBq8', 'tjc1lr5Ufp', 'QZc1NwCmd8', 'UFZy6OlphKRAOAT4LVf', 'uS5UNkl597QKMEWvZ3M', 'YMo6lilHUBBnHIcFaMU', 'pr5ZUJlgNjqsNUKmDj0', 'sxLguZlEAMsRGujPStU'

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

File created: C:\Users\user\AppData\Roaming\ApplicationUrl.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Memory allocated: 259A5340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Memory allocated: 259BEC60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Memory allocated: 1F3C35A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Memory allocated: 1F3DD0D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Memory allocated: 28823710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Memory allocated: 2883CF10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Memory allocated: 1FD73DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Memory allocated: 1FD75770000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

Code function: 0_2_00007FFAAC36C5C0 sldt word ptr [eax]

0_2_00007FFAAC36C5C0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599013	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598684	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598416	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598294	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598184	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595728	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595606	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599339	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597902	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597449	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597098	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595077	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594857	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594530	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 8183	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1670	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7026	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2815	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6584	Thread sleep count: 8183 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6584	Thread sleep count: 1670 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -599013s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -598684s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -598577s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -598416s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -598294s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -598184s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -597641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -596422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -595728s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -595606s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -594813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6572	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2384	Thread sleep count: 7026 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2384	Thread sleep count: 2815 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -599339s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -597902s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -597671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -597449s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -597098s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -596749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -596421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -595530s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -595077s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -594857s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -594749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2040	Thread sleep time: -594530s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599013	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598684	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598416	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598294	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598184	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595728	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595606	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599339	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597902	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597449	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597098	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595077	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594857	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594530	Jump to behavior

Source: wscript.exe, 00000003.00000003.1659174821.000001976A1B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yGF5
Source: MSBuild.exe, 00000005.00000002.3997394423.000001FD73CBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|
Source: ApplicationUrl.exe, 00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: ApplicationUrl.exe, 00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: MSBuild.exe, 00000002.00000002.3989081974.000001F3C34D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 140000000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 140000000 value starts with: 4D5A			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Thread register set: target process: 2004			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Thread register set: target process: 4912			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 140000000	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 140002000	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 140022000	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: E209B93010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 140000000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 140002000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 140022000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 735B04010	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\ApplicationUrl.exe "C:\Users\user\AppData\Roaming\ApplicationUrl.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe	Queries volume information: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationUrl.exe	Queries volume information: C:\Users\user\AppData\Roaming\ApplicationUrl.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3993061592.000001F3C531C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3988703094.000001FD00257000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3993061592.000001F3C50D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3988703094.000001FD00001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ApplicationUrl.exe PID: 2008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4912, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ApplicationUrl.exe PID: 2008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4912, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 4.2.ApplicationUrl.exe.288353c6aa0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ApplicationUrl.exe.288353c6aa0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA pdf.exe.259b6c71a78.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ApplicationUrl.exe.28835378268.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3993061592.000001F3C531C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3988703094.000001FD00257000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3993061592.000001F3C50D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3988703094.000001FD00001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA pdf.exe PID: 5312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ApplicationUrl.exe PID: 2008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4912, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	1 Scheduled Task/Job	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	311 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PROFORMA FATURA pdf.exe	42%	ReversingLabs	Win64.Trojan.GenSteal
PROFORMA FATURA pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\ApplicationUrl.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ApplicationUrl.exe	42%	ReversingLabs	Win64.Trojan.GenSteal

Source	Detection	Scanner	Label
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
checkip.dyndns.com	193.122.6.168	true	true	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	true	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/173.254.250.77	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-neti	PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/14436606/23354	PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org/v	MSBuild.exe, 00000002.00000002.3991155326.000001F3C4E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/11564914/23354;	PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://reallyfreegeoip.org	MSBuild.exe, 00000002.00000002.3993061592.000001F3C5283000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5308000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C51FC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5297000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52AB000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52F5000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00137000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001E6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00243000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00230000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-net	PROFORMA FATURA pdf.exe, 00000000.00000002.1555610319.00000259BF540000.00000004.08000000.00040000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.00000288352DB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	MSBuild.exe, 00000002.00000002.3993061592.000001F3C5283000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5308000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5297000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C51DC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52AB000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52F5000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C522B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001E6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00166000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00243000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00230000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/~	MSBuild.exe, 00000002.00000002.3991155326.000001F3C4E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD0020E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00230000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/173.254.250.77p	MSBuild.exe, 00000002.00000002.3993061592.000001F3C51DC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.com	MSBuild.exe, 00000002.00000002.3993061592.000001F3C5283000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5308000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C5297000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C51DC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52AB000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C52F5000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001BF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001E6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD001FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00243000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00230000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A71D7000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C50D1000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.000002882548F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndn	MSBuild.exe, 00000002.00000002.3991155326.000001F3C4E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/	PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA pdf.exe, 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3993061592.000001F3C51DC000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, ApplicationUrl.exe, 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3988703094.000001FD00117000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	reallyfreegeoip.org	European Union		13335	CLOUDFLARENETUS	true
193.122.6.168	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545969
Start date and time:	2024-10-31 10:57:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	PROFORMA FATURA pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@8/3@2/2
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 72% Number of executed functions: 299 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 199.232.210.172, 52.165.164.15, 52.149.20.212
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target MSBuild.exe, PID 2004 because it is empty
Execution Graph export aborted for target MSBuild.exe, PID 4912 because it is empty
Execution Graph export aborted for target PROFORMA FATURA pdf.exe, PID 5312 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: PROFORMA FATURA pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
05:58:57	API Interceptor	15906069x Sleep call for process: MSBuild.exe modified
10:58:55	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	18in SPA-198-2024.exe	Get hash	malicious	FormBook	Browse	www.timizoasisey.shop/3p0l/
	lf1SPbZI3V.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	Comprobante de pago.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/vdlzo
	Purchase_Order_pdf.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/g48c/
	zxalphamn.doc	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	rPO-000172483.exe	Get hash	malicious	FormBook	Browse	www.launchdreamidea.xyz/2b9b/
	rPO_28102400.exe	Get hash	malicious	Lokibot	Browse	ghcopz.shop/ClarkB/PWS/fre.php
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
193.122.6.168	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	z1MRforsteamDRUM-A1_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	INVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	z19UrgentOrder.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Invoices.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	FERRO FAB INV.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	pedido.pif.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PRESUPUESTO DE NOVIEMBRE...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Gun Ici Cek Statu Listesi.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	PO Number- 4900003753.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	Purchase Order 17025.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	PO 4500580954.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	rCommercialoffer_Technicaloffer_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
bg.microsoft.map.fastly.net	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	4266212121326821689.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	16804547213639850.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	https://invite.bublup.com/q6fU7gLtMrfS	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	Proposal From SIOLI Alexander Pino#U2026.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	184085606271511815.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	new order - PO 351081.exe	Get hash	malicious	AgentTesla	Browse	199.232.214.172
	UCLouvain.onepkg	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.kwconnect.com/redirect?url=https%3A%2F%2Fwww.ingenieriawj.com/trx/#XdGFtYXJhLnBlcmVpcmFkZWplc3VzQGRhaWljaGktc2Fua3lvLmV1	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
s-part-0017.t-0009.fb-t-msedge.net	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.45
	whatsappjpg.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	13.107.253.45
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	13.107.253.45
	UCLouvain.onepkg	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://www.kwconnect.com/redirect?url=https%3A%2F%2Fwww.ingenieriawj.com/trx/#XdGFtYXJhLnBlcmVpcmFkZWplc3VzQGRhaWljaGktc2Fua3lvLmV1	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	67JPbskewt.exe	Get hash	malicious	Unknown	Browse	13.107.253.45
	Receipt.htm	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	13.107.253.45
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.253.45
	https://www.leadsonline.ca	Get hash	malicious	Unknown	Browse	13.107.253.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Invoices.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	FERRO FAB INV.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	pedido.pif.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Gun Ici Cek Statu Listesi.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	PO Number- 4900003753.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	PO 4500580954.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	PG567777878-H677889978-6G89O9I4567778.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	INVOICE.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
CLOUDFLARENETUS	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Invoices.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	104.17.25.14
	FERRO FAB INV.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	#Uad6c#Ub9e4 #Uc8fc#Ubb38 658749 #Ubc0f 658752..exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://invite.bublup.com/q6fU7gLtMrfS	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	.gov.ua.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	pedido.pif.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Proposal From SIOLI Alexander Pino#U2026.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.45
	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://invite.bublup.com/q6fU7gLtMrfS	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	Proposal From SIOLI Alexander Pino#U2026.pdf	Get hash	malicious	Unknown	Browse	13.107.253.45
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	13.107.253.45
	.gov.ua.html	Get hash	malicious	Unknown	Browse	13.107.253.45
	new order - PO 351081.exe	Get hash	malicious	AgentTesla	Browse	13.107.253.45
	http://archzine.net	Get hash	malicious	Unknown	Browse	13.107.253.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.253.45
	I43xo3KKfS.exe	Get hash	malicious	Stealc	Browse	13.107.253.45
54328bd36c14bd82ddaa0c04b25ed9ad	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Invoices.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FERRO FAB INV.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	pedido.pif.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PRESUPUESTO DE NOVIEMBRE...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Gun Ici Cek Statu Listesi.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	PO Number- 4900003753.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	Purchase Order 17025.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	PO 4500580954.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	rCommercialoffer_Technicaloffer_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3

Process:	C:\Users\user\Desktop\PROFORMA FATURA pdf.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	970752
Entropy (8bit):	7.995264131519772
Encrypted:	true
SSDEEP:	24576:sGF+CJcIc+trkIpbcf1luQnZ/uzzFxiXKjoeKxEfDhI5/3:DxcIfrxC1EQZczFoajoeKic/
MD5:	1A74C66D4750248AF37FE8CB959560CD
SHA1:	8D4DE0FD49E567ED59FF6E0EFB62FF43DE76E841
SHA-256:	2CC00A298C3BD523EACE30D8740AB9D42BBA63CE8CEBCDA5A3C3C52AC801A413
SHA-512:	5B7CB8215E5B089C16BDB27207399BA2F059862272F8E4125858940A910581E48C7ADE8C9C0FCA2BC9CE13C06A76692DA582C5246EC9ADD660FF96420FF48874
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...U.!g................................. ....@...... ....................... ............`...@......@............... ............................................................................................................................... ..H............text...p.... ...................... ..`.rsrc...............................@..@........................................H........?...$...........c.................................................(.......(.....0.......... ........8........E........6.......8....~....%9....86...& ....~....{A...9....& ....8....~..........s....%.....s....(.... ....~....{....:....& ....8z...&~..........~......s...........(.....0..#....... ........8........E............5...G...i...H.......Y....... ...~................... .......~.......i.......8......(....(....:.... ....8....s....%r...po....%rM..po...... ....8`.....

C:\Users\user\AppData\Roaming\ApplicationUrl.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PROFORMA FATURA pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs

Download File

Process:	C:\Users\user\Desktop\PROFORMA FATURA pdf.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.786815941100202
Encrypted:	false
SSDEEP:	3:FER/n0eFHHo0nacwREaKC5AkRMQwXHHn:FER/lFHIcNwiaZ5QX
MD5:	F7E8FC62F9E6CCCFE29505AFF2E6AA2D
SHA1:	CBD6853050FA4A15C1F55E12A79185573B5EB6D5
SHA-256:	A20A380D57247575415D824355DE70B58BEF7CC91834203E88ECF2D693218F79
SHA-512:	AAA6CC094092FA6C2BF88853D78960AA0723AF7AE39F9B8B7C5D264F54B208DFDAD0C72C7C1247CF9F368D3CB9BA1694462CAA183CB7EC90A0923823CE8C8B20
Malicious:	true
Reputation:	low
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\ApplicationUrl.exe"""

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.995264131519772
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	PROFORMA FATURA pdf.exe
File size:	970'752 bytes
MD5:	1a74c66d4750248af37fe8cb959560cd
SHA1:	8d4de0fd49e567ed59ff6e0efb62ff43de76e841
SHA256:	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413
SHA512:	5b7cb8215e5b089c16bdb27207399ba2f059862272f8e4125858940a910581e48c7ade8c9c0fca2bc9ce13c06a76692da582c5246ec9add660ff96420ff48874
SSDEEP:	24576:sGF+CJcIc+trkIpbcf1luQnZ/uzzFxiXKjoeKxEfDhI5/3:DxcIfrxC1EQZczFoajoeKic/
TLSH:	972533833DA91BE0C95382FD1A8395A43775A08EEB06DF745446BA2F428334F565EBCC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...U.!g................................. ....@...... ....................... ............`...@......@............... .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6721EF55 [Wed Oct 30 08:33:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf0000	0x5a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xec670	0xec800	cf6931aa31b0ac75cca64f1e41263280	False	0.9926396505021141	data	7.996595385701048	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf0000	0x5a8	0x600	e5990cbc58be2a366912169ef7125d38	False	0.419921875	data	4.097691683071214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xf00a0	0x31c	data			0.4321608040201005
RT_MANIFEST	0xf03bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T10:58:55.619997+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49702	193.122.6.168	80	TCP
2024-10-31T10:58:57.575086+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49702	193.122.6.168	80	TCP
2024-10-31T10:58:58.303061+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49704	188.114.97.3	443	TCP
2024-10-31T10:58:59.198131+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49705	193.122.6.168	80	TCP
2024-10-31T10:58:59.944346+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49706	188.114.97.3	443	TCP
2024-10-31T10:59:07.682566+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49715	193.122.6.168	80	TCP
2024-10-31T10:59:08.073351+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49717	188.114.97.3	443	TCP
2024-10-31T10:59:08.776351+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49715	193.122.6.168	80	TCP
2024-10-31T10:59:09.499379+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49720	188.114.97.3	443	TCP
2024-10-31T10:59:10.401358+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49722	193.122.6.168	80	TCP
2024-10-31T10:59:14.381416+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49729	188.114.97.3	443	TCP
2024-10-31T10:59:16.001575+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49731	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 10:58:46.999138117 CET	443	49701	104.98.116.138	192.168.2.7
Oct 31, 2024 10:58:46.999332905 CET	49701	443	192.168.2.7	104.98.116.138
Oct 31, 2024 10:58:47.666932106 CET	49674	443	192.168.2.7	104.98.116.138
Oct 31, 2024 10:58:47.854422092 CET	49672	443	192.168.2.7	104.98.116.138
Oct 31, 2024 10:58:49.213881016 CET	49677	443	192.168.2.7	20.50.201.200
Oct 31, 2024 10:58:54.455591917 CET	49702	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:54.460511923 CET	80	49702	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:54.460608006 CET	49702	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:54.461889029 CET	49702	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:54.466651917 CET	80	49702	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:55.320729017 CET	80	49702	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:55.327677965 CET	49702	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:55.332736015 CET	80	49702	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:55.574646950 CET	80	49702	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:55.603280067 CET	49703	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:55.603347063 CET	443	49703	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:55.603421926 CET	49703	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:55.614947081 CET	49703	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:55.614969969 CET	443	49703	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:55.619997025 CET	49702	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:56.235424995 CET	443	49703	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:56.235531092 CET	49703	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:56.325687885 CET	49703	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:56.325726032 CET	443	49703	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:56.326123953 CET	443	49703	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:56.370014906 CET	49703	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:56.789180040 CET	49703	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:56.831358910 CET	443	49703	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:57.272433043 CET	443	49703	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:57.272535086 CET	443	49703	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:57.272617102 CET	49703	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:57.276273012 CET	49674	443	192.168.2.7	104.98.116.138
Oct 31, 2024 10:58:57.280617952 CET	49703	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:57.284074068 CET	49702	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:57.289062977 CET	80	49702	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:57.463829041 CET	49672	443	192.168.2.7	104.98.116.138
Oct 31, 2024 10:58:57.530654907 CET	80	49702	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:57.534328938 CET	49704	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:57.534369946 CET	443	49704	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:57.534454107 CET	49704	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:57.534765005 CET	49704	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:57.534779072 CET	443	49704	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:57.575086117 CET	49702	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:58.149233103 CET	443	49704	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:58.152256012 CET	49704	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:58.152282000 CET	443	49704	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:58.303078890 CET	443	49704	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:58.303205013 CET	443	49704	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:58.303251028 CET	49704	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:58.303978920 CET	49704	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:58.307159901 CET	49702	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:58.308443069 CET	49705	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:58.312693119 CET	80	49702	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:58.312784910 CET	49702	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:58.313359022 CET	80	49705	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:58.313422918 CET	49705	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:58.313500881 CET	49705	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:58.318279028 CET	80	49705	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:59.147571087 CET	80	49705	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:59.160341024 CET	49706	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:59.160387993 CET	443	49706	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:59.160470009 CET	49706	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:59.164235115 CET	49706	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:59.164253950 CET	443	49706	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:59.198131084 CET	49705	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:59.798809052 CET	443	49706	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:59.800226927 CET	49706	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:59.800247908 CET	443	49706	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:59.944355011 CET	443	49706	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:59.944458961 CET	443	49706	188.114.97.3	192.168.2.7
Oct 31, 2024 10:58:59.944523096 CET	49706	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:59.945137024 CET	49706	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:58:59.949551105 CET	49707	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:59.954534054 CET	80	49707	193.122.6.168	192.168.2.7
Oct 31, 2024 10:58:59.954606056 CET	49707	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:59.954694033 CET	49707	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:58:59.959507942 CET	80	49707	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:00.800288916 CET	80	49707	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:00.801877022 CET	49708	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:00.801920891 CET	443	49708	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:00.801980972 CET	49708	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:00.802256107 CET	49708	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:00.802270889 CET	443	49708	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:00.854393005 CET	49707	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:01.407635927 CET	443	49708	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:01.408823013 CET	49708	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:01.408858061 CET	443	49708	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:01.547801018 CET	443	49708	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:01.547887087 CET	443	49708	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:01.547976017 CET	49708	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:01.548710108 CET	49708	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:01.551798105 CET	49707	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:01.552356958 CET	49709	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:01.557365894 CET	80	49709	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:01.557468891 CET	49709	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:01.557662964 CET	49709	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:01.557873011 CET	80	49707	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:01.557923079 CET	49707	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:01.562477112 CET	80	49709	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:02.430973053 CET	80	49709	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:02.432693958 CET	49710	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:02.432723999 CET	443	49710	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:02.432802916 CET	49710	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:02.433073044 CET	49710	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:02.433085918 CET	443	49710	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:02.479454041 CET	49709	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:03.038127899 CET	443	49710	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:03.039753914 CET	49710	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:03.039786100 CET	443	49710	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:03.181535006 CET	443	49710	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:03.181637049 CET	443	49710	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:03.181735039 CET	49710	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:03.182384968 CET	49710	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:03.186014891 CET	49709	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:03.186552048 CET	49711	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:03.191299915 CET	80	49709	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:03.191346884 CET	80	49711	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:03.191477060 CET	49709	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:03.191477060 CET	49711	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:03.191597939 CET	49711	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:03.196368933 CET	80	49711	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:04.028640985 CET	80	49711	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:04.030181885 CET	49712	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:04.030225039 CET	443	49712	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:04.030424118 CET	49712	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:04.030733109 CET	49712	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:04.030745983 CET	443	49712	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:04.073203087 CET	49711	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:04.657044888 CET	443	49712	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:04.668030977 CET	49712	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:04.668054104 CET	443	49712	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:04.811547041 CET	443	49712	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:04.811657906 CET	443	49712	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:04.811729908 CET	49712	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:04.812621117 CET	49712	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:04.816878080 CET	49711	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:04.818128109 CET	49713	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:04.822273016 CET	80	49711	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:04.822350979 CET	49711	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:04.823009014 CET	80	49713	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:04.823112011 CET	49713	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:04.824198961 CET	49713	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:04.829138041 CET	80	49713	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:05.667422056 CET	80	49713	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:05.672925949 CET	49714	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:05.672971010 CET	443	49714	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:05.673079014 CET	49714	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:05.673430920 CET	49714	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:05.673444033 CET	443	49714	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:05.713927031 CET	49713	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:06.213753939 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:06.218970060 CET	80	49715	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:06.219125986 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:06.219441891 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:06.224190950 CET	80	49715	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:06.285965919 CET	443	49714	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:06.292711020 CET	49714	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:06.292753935 CET	443	49714	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:06.432925940 CET	443	49714	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:06.433132887 CET	443	49714	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:06.433212996 CET	49714	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:06.434081078 CET	49714	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:06.437854052 CET	49713	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:06.439066887 CET	49716	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:06.443558931 CET	80	49713	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:06.443623066 CET	49713	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:06.443917036 CET	80	49716	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:06.444144011 CET	49716	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:06.444144011 CET	49716	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:06.449044943 CET	80	49716	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:07.052418947 CET	80	49715	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:07.104439020 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:07.280073881 CET	80	49716	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:07.293438911 CET	49717	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:07.293494940 CET	443	49717	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:07.293828011 CET	49717	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:07.294482946 CET	49717	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:07.294495106 CET	443	49717	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:07.323244095 CET	49716	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:07.395700932 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:07.400741100 CET	80	49715	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:07.639008045 CET	80	49715	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:07.650134087 CET	49718	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:07.650185108 CET	443	49718	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:07.650257111 CET	49718	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:07.655224085 CET	49718	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:07.655240059 CET	443	49718	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:07.682565928 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:07.911932945 CET	443	49717	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:07.913606882 CET	49717	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:07.913618088 CET	443	49717	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.073367119 CET	443	49717	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.073478937 CET	443	49717	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.073524952 CET	49717	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.074532986 CET	49717	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.272362947 CET	443	49718	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.272449970 CET	49718	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.274688005 CET	49718	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.274703979 CET	443	49718	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.274996042 CET	443	49718	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.323200941 CET	49718	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.341111898 CET	49718	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.383336067 CET	443	49718	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.479969978 CET	443	49718	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.480077028 CET	443	49718	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.480122089 CET	49718	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.484183073 CET	49718	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.487826109 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:08.492846012 CET	80	49715	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:08.732830048 CET	80	49715	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:08.735580921 CET	49720	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.735640049 CET	443	49720	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.735805035 CET	49720	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.736165047 CET	49720	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:08.736180067 CET	443	49720	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:08.776350975 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:09.357621908 CET	443	49720	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:09.361495018 CET	49720	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:09.361512899 CET	443	49720	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:09.499387026 CET	443	49720	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:09.499501944 CET	443	49720	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:09.499603987 CET	49720	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:09.500462055 CET	49720	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:09.504384995 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:09.505637884 CET	49722	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:09.510474920 CET	80	49715	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:09.510629892 CET	80	49722	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:09.510749102 CET	49715	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:09.510792017 CET	49722	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:09.511141062 CET	49722	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:09.516573906 CET	80	49722	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:10.358259916 CET	80	49722	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:10.359891891 CET	49725	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:10.359936953 CET	443	49725	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:10.360063076 CET	49725	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:10.360397100 CET	49725	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:10.360409021 CET	443	49725	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:10.401357889 CET	49722	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:10.968240023 CET	443	49725	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:10.982534885 CET	49725	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:10.982554913 CET	443	49725	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:11.118170023 CET	443	49725	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:11.118283033 CET	443	49725	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:11.118447065 CET	49725	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:11.120531082 CET	49725	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:11.135327101 CET	49726	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:11.140254974 CET	80	49726	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:11.140331030 CET	49726	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:11.140547991 CET	49726	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:11.145319939 CET	80	49726	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:12.006644964 CET	80	49726	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:12.008919954 CET	49727	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:12.008960962 CET	443	49727	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:12.009057045 CET	49727	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:12.009485006 CET	49727	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:12.009495974 CET	443	49727	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:12.057614088 CET	49726	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:12.614825010 CET	443	49727	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:12.616673946 CET	49727	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:12.616698027 CET	443	49727	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:12.757740021 CET	443	49727	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:12.757942915 CET	443	49727	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:12.758054018 CET	49727	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:12.758838892 CET	49727	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:12.763266087 CET	49726	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:12.764668941 CET	49728	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:12.769804955 CET	80	49726	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:12.769905090 CET	49726	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:12.770934105 CET	80	49728	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:12.771019936 CET	49728	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:12.771184921 CET	49728	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:12.776824951 CET	80	49728	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:13.617052078 CET	80	49728	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:13.618959904 CET	49729	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:13.619019985 CET	443	49729	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:13.619117975 CET	49729	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:13.619451046 CET	49729	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:13.619462967 CET	443	49729	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:13.667015076 CET	49728	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:14.235126972 CET	443	49729	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:14.237407923 CET	49729	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:14.237441063 CET	443	49729	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:14.381426096 CET	443	49729	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:14.381563902 CET	443	49729	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:14.381633043 CET	49729	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:14.382395983 CET	49729	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:14.386394978 CET	49728	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:14.387622118 CET	49730	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:14.391746998 CET	80	49728	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:14.391848087 CET	49728	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:14.392522097 CET	80	49730	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:14.392606020 CET	49730	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:14.392796040 CET	49730	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:14.397875071 CET	80	49730	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:15.235862970 CET	80	49730	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:15.237701893 CET	49731	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:15.237756014 CET	443	49731	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:15.237901926 CET	49731	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:15.238512039 CET	49731	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:15.238534927 CET	443	49731	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:15.276379108 CET	49730	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:15.858810902 CET	443	49731	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:15.860333920 CET	49731	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:15.860385895 CET	443	49731	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:16.001647949 CET	443	49731	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:16.001935005 CET	443	49731	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:16.001995087 CET	49731	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:16.002918005 CET	49731	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:16.007311106 CET	49730	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:16.007932901 CET	49732	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:16.012784004 CET	80	49730	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:16.012837887 CET	49730	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:16.012844086 CET	80	49732	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:16.012912035 CET	49732	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:16.013030052 CET	49732	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:16.017906904 CET	80	49732	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:16.848625898 CET	80	49732	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:16.850613117 CET	49733	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:16.850644112 CET	443	49733	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:16.851041079 CET	49733	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:16.851079941 CET	49733	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:16.851085901 CET	443	49733	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:16.901443958 CET	49732	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:17.450599909 CET	443	49733	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:17.452266932 CET	49733	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:17.452282906 CET	443	49733	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:17.589421988 CET	443	49733	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:17.589507103 CET	443	49733	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:17.589705944 CET	49733	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:17.590553999 CET	49733	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:17.594397068 CET	49732	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:17.595815897 CET	49734	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:17.599850893 CET	80	49732	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:17.599984884 CET	49732	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:17.600717068 CET	80	49734	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:17.600825071 CET	49734	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:17.600940943 CET	49734	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:17.605731010 CET	80	49734	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:18.431102991 CET	80	49734	193.122.6.168	192.168.2.7
Oct 31, 2024 10:59:18.432765961 CET	49735	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:18.432811022 CET	443	49735	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:18.432996035 CET	49735	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:18.433198929 CET	49735	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:18.433208942 CET	443	49735	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:18.479530096 CET	49734	80	192.168.2.7	193.122.6.168
Oct 31, 2024 10:59:19.046324968 CET	443	49735	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:19.048943996 CET	49735	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:19.048963070 CET	443	49735	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:19.187086105 CET	443	49735	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:19.187174082 CET	443	49735	188.114.97.3	192.168.2.7
Oct 31, 2024 10:59:19.187330961 CET	49735	443	192.168.2.7	188.114.97.3
Oct 31, 2024 10:59:19.188051939 CET	49735	443	192.168.2.7	188.114.97.3
Oct 31, 2024 11:00:04.268942118 CET	80	49705	193.122.6.168	192.168.2.7
Oct 31, 2024 11:00:04.269071102 CET	49705	80	192.168.2.7	193.122.6.168
Oct 31, 2024 11:00:04.285677910 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:04.285733938 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:04.285840034 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:04.286212921 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:04.286222935 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.045600891 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.045885086 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.047455072 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.047466993 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.047713041 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.059423923 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.103327990 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.284118891 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.284145117 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.284235001 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.284280062 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.284354925 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.284393072 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.284416914 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.311460972 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.311486006 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.311609983 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.311630964 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.311691999 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.398775101 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.398802042 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.398942947 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.398988008 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.399076939 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.425918102 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.425951004 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.426270008 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.426337004 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.426450968 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.427949905 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.427987099 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.428067923 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.428082943 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.428157091 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.980890036 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.980900049 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.980952978 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.981065035 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.981137991 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.981184006 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.981209040 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.981221914 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.981239080 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.981288910 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.981306076 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.981364965 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.981828928 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.981847048 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.981918097 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.981931925 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.982007027 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.982350111 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.982366085 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.982425928 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.982440948 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.982491016 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.987596989 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.987616062 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.987706900 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.987724066 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.987778902 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.988764048 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.988780022 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.988837957 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.988852024 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.988903999 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.990612984 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.990628958 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.990706921 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.990721941 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.990786076 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.992398977 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.992413998 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.992472887 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.992487907 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.992559910 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.993242979 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.993316889 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.993335962 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.993386984 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.993439913 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.993479967 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:05.993526936 CET	49737	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:05.993541956 CET	443	49737	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.039118052 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.039166927 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.039299965 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.040765047 CET	49739	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.040829897 CET	443	49739	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.040900946 CET	49739	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.041457891 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.041466951 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.041929960 CET	49739	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.041949034 CET	443	49739	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.043044090 CET	49740	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.043075085 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.043133974 CET	49740	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.043256998 CET	49740	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.043262959 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.044178963 CET	49741	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.044225931 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.044286966 CET	49741	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.044920921 CET	49742	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.044929028 CET	443	49742	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.044979095 CET	49742	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.045104980 CET	49742	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.045109034 CET	443	49742	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.045214891 CET	49741	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.045234919 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.790862083 CET	443	49739	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.791881084 CET	49739	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.791950941 CET	443	49739	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.792160988 CET	443	49742	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.792604923 CET	49739	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.792622089 CET	443	49739	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.792917967 CET	49742	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.792965889 CET	443	49742	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.793431044 CET	49742	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.793437004 CET	443	49742	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.799726009 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.800235033 CET	49741	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.800273895 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.800761938 CET	49741	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.800772905 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.807687044 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.808557034 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.808655977 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.808995962 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.809014082 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.819926023 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.820511103 CET	49740	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.820533037 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.820981026 CET	49740	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.820986032 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.926671982 CET	443	49739	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.926779985 CET	443	49739	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.926851988 CET	49739	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.927088976 CET	49739	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.927108049 CET	443	49739	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.927141905 CET	49739	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.927146912 CET	443	49739	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.928376913 CET	443	49742	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.928469896 CET	443	49742	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.928524971 CET	49742	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.928648949 CET	49742	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.928666115 CET	443	49742	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.928679943 CET	49742	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.928684950 CET	443	49742	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.930597067 CET	49743	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.930644035 CET	443	49743	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.930717945 CET	49743	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.930910110 CET	49743	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.930926085 CET	443	49743	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.931206942 CET	49744	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.931240082 CET	443	49744	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.931299925 CET	49744	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.931440115 CET	49744	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.931449890 CET	443	49744	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.939641953 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.939668894 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.939713955 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.939744949 CET	49741	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.939920902 CET	49741	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.940045118 CET	49741	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.940059900 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.940072060 CET	49741	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.940076113 CET	443	49741	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.943356037 CET	49745	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.943394899 CET	443	49745	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.943490982 CET	49745	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.943675041 CET	49745	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.943686008 CET	443	49745	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.947266102 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.947288990 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.947361946 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.947381020 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.947402000 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.947424889 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.947454929 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.947665930 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.947675943 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.947689056 CET	49738	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.947693110 CET	443	49738	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.950761080 CET	49746	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.950786114 CET	443	49746	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.950839043 CET	49746	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.950974941 CET	49746	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.950983047 CET	443	49746	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.973901987 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.973932028 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.974009037 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.974095106 CET	49740	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.974127054 CET	49740	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.974545956 CET	49740	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.974560976 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.974577904 CET	49740	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.974582911 CET	443	49740	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.978315115 CET	49747	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.978349924 CET	443	49747	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:06.978437901 CET	49747	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.978629112 CET	49747	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:06.978638887 CET	443	49747	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.693490982 CET	443	49744	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.694250107 CET	49744	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.694272041 CET	443	49744	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.694716930 CET	49744	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.694720984 CET	443	49744	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.700278044 CET	443	49743	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.700720072 CET	443	49745	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.700813055 CET	49743	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.700819969 CET	443	49746	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.700830936 CET	443	49743	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.701170921 CET	49745	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.701195002 CET	443	49745	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.701266050 CET	49743	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.701272011 CET	443	49743	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.701571941 CET	49746	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.701582909 CET	443	49746	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.701750040 CET	49745	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.701756954 CET	443	49745	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.701937914 CET	49746	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.701941967 CET	443	49746	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.733443975 CET	443	49747	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.734213114 CET	49747	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.734292984 CET	443	49747	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.734740973 CET	49747	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.734765053 CET	443	49747	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.844620943 CET	443	49743	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.844693899 CET	443	49743	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.844753027 CET	49743	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.844784975 CET	443	49745	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.844835043 CET	443	49745	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.844897032 CET	49745	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.844939947 CET	443	49746	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.844999075 CET	443	49746	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.845037937 CET	49746	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.845077038 CET	49743	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.845093012 CET	443	49743	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.845094919 CET	49745	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.845108986 CET	49743	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.845113993 CET	443	49745	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.845114946 CET	443	49743	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.845129967 CET	49745	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.845135927 CET	443	49745	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.846040010 CET	49746	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.846052885 CET	443	49746	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.846071959 CET	49746	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.846076965 CET	443	49746	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.847578049 CET	443	49744	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.847634077 CET	443	49744	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.847683907 CET	49744	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.848900080 CET	49748	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.848927021 CET	443	49748	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.848982096 CET	49748	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849111080 CET	49744	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849114895 CET	443	49744	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.849126101 CET	49744	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849129915 CET	443	49744	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.849220037 CET	49748	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849232912 CET	443	49748	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.849406958 CET	49749	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849442959 CET	443	49749	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.849486113 CET	49749	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849611998 CET	49749	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849621058 CET	443	49749	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.849704981 CET	49750	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849715948 CET	443	49750	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.849756956 CET	49750	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849860907 CET	49750	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.849872112 CET	443	49750	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.851331949 CET	49751	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.851340055 CET	443	49751	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.851402044 CET	49751	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.851505041 CET	49751	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.851514101 CET	443	49751	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.870937109 CET	443	49747	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.871001959 CET	443	49747	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.871052980 CET	49747	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.871303082 CET	49747	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.871319056 CET	443	49747	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.871326923 CET	49747	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.871331930 CET	443	49747	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.874556065 CET	49752	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.874598026 CET	443	49752	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:07.874744892 CET	49752	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.874938965 CET	49752	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:07.874953032 CET	443	49752	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.600347996 CET	443	49750	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.601010084 CET	49750	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.601042032 CET	443	49750	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.601782084 CET	49750	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.601788998 CET	443	49750	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.607274055 CET	443	49749	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.607747078 CET	49749	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.607815027 CET	443	49749	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.608228922 CET	49749	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.608243942 CET	443	49749	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.614125967 CET	443	49751	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.614554882 CET	49751	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.614588022 CET	443	49751	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.615164995 CET	49751	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.615175962 CET	443	49751	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.615627050 CET	443	49748	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.615982056 CET	49748	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.615997076 CET	443	49748	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.616400957 CET	49748	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.616406918 CET	443	49748	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.629050970 CET	443	49752	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.629542112 CET	49752	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.629559040 CET	443	49752	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.630126953 CET	49752	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.630134106 CET	443	49752	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.736686945 CET	443	49750	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.737431049 CET	443	49750	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.737665892 CET	49750	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.737665892 CET	49750	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.737665892 CET	49750	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.740190983 CET	49753	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.740299940 CET	443	49753	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.740390062 CET	49753	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.740529060 CET	49753	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.740566015 CET	443	49753	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.745021105 CET	443	49749	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.745121002 CET	443	49749	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.745193958 CET	49749	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.745290041 CET	49749	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.745290041 CET	49749	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.745337963 CET	443	49749	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.745369911 CET	443	49749	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.747406960 CET	49754	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.747442007 CET	443	49754	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.747530937 CET	49754	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.747644901 CET	49754	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.747661114 CET	443	49754	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.752157927 CET	443	49748	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.752306938 CET	443	49748	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.752378941 CET	49748	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.752410889 CET	49748	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.752429008 CET	443	49748	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.752441883 CET	49748	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.752446890 CET	443	49748	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.753869057 CET	443	49751	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.754082918 CET	443	49751	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.754143953 CET	49751	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.754215002 CET	49751	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.754235029 CET	443	49751	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.754260063 CET	49751	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.754273891 CET	443	49751	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.754419088 CET	49755	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.754453897 CET	443	49755	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.754523993 CET	49755	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.754616976 CET	49755	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.754631042 CET	443	49755	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.755975008 CET	49756	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.756011963 CET	443	49756	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.756083965 CET	49756	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.756207943 CET	49756	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.756222963 CET	443	49756	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.765964985 CET	443	49752	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.766215086 CET	443	49752	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.766290903 CET	49752	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.766448021 CET	49752	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.766448021 CET	49752	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.766458035 CET	443	49752	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.766474009 CET	443	49752	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.768007040 CET	49757	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.768038034 CET	443	49757	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:08.768112898 CET	49757	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.768230915 CET	49757	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:08.768240929 CET	443	49757	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.042443037 CET	49750	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.042473078 CET	443	49750	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.661207914 CET	443	49754	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.661504030 CET	443	49753	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.661755085 CET	443	49755	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.661982059 CET	49754	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.661997080 CET	443	49754	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.662035942 CET	443	49756	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.662105083 CET	49753	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.662141085 CET	443	49753	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.662580967 CET	49753	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.662591934 CET	443	49753	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.662691116 CET	49754	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.662707090 CET	443	49754	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.662827015 CET	49755	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.662836075 CET	443	49755	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.663009882 CET	49756	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.663028002 CET	443	49756	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.663233042 CET	49755	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.663239002 CET	443	49755	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.663507938 CET	49756	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.663513899 CET	443	49756	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.796365023 CET	443	49754	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.796616077 CET	443	49754	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.796711922 CET	49754	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.796792984 CET	49754	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.796792984 CET	49754	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.796813965 CET	443	49754	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.796824932 CET	443	49754	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.797744989 CET	443	49753	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.798156023 CET	443	49753	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.798289061 CET	49753	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.798351049 CET	49753	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.798377991 CET	443	49753	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.798394918 CET	49753	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.798402071 CET	443	49753	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.798443079 CET	443	49757	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.799841881 CET	443	49755	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.799916983 CET	443	49755	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.799988985 CET	49755	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.800256968 CET	49757	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.800276041 CET	443	49757	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.800731897 CET	49757	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.800736904 CET	443	49757	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.800802946 CET	443	49756	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.801301003 CET	443	49756	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.801358938 CET	49756	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.801512003 CET	49756	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.801525116 CET	443	49756	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.801594973 CET	49756	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.801599979 CET	443	49756	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.802217960 CET	49755	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.802238941 CET	443	49755	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.802284956 CET	49755	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.802290916 CET	443	49755	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.802655935 CET	49758	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.802680969 CET	443	49758	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.802911043 CET	49758	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.803235054 CET	49758	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.803247929 CET	443	49758	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.804073095 CET	49759	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.804101944 CET	443	49759	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.804191113 CET	49759	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.804410934 CET	49759	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.804420948 CET	443	49759	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.805835962 CET	49760	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.805926085 CET	443	49760	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.806035042 CET	49761	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.806056023 CET	49760	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.806068897 CET	443	49761	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.806176901 CET	49760	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.806183100 CET	49761	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.806205988 CET	443	49760	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.806318998 CET	49761	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.806329012 CET	443	49761	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.941529989 CET	443	49757	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.941603899 CET	443	49757	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.941854954 CET	49757	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.943480968 CET	49757	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.943500996 CET	443	49757	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.943514109 CET	49757	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.943519115 CET	443	49757	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.946655035 CET	49762	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.946698904 CET	443	49762	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:09.946794987 CET	49762	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.946930885 CET	49762	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:09.946943998 CET	443	49762	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.551728964 CET	443	49761	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.552411079 CET	49761	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.552443027 CET	443	49761	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.552967072 CET	49761	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.552974939 CET	443	49761	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.564208984 CET	443	49758	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.564829111 CET	49758	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.564845085 CET	443	49758	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.565026045 CET	443	49760	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.565327883 CET	49760	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.565335035 CET	49758	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.565344095 CET	443	49758	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.565357924 CET	443	49760	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.565572023 CET	443	49759	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.565812111 CET	49760	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.565818071 CET	443	49760	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.565939903 CET	49759	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.565959930 CET	443	49759	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.566317081 CET	49759	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.566322088 CET	443	49759	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.687879086 CET	443	49761	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.687983036 CET	443	49761	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.688049078 CET	49761	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.688236952 CET	49761	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.688256979 CET	443	49761	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.688282013 CET	49761	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.688287973 CET	443	49761	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.691755056 CET	49763	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.691783905 CET	443	49763	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.691873074 CET	49763	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.692069054 CET	49763	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.692080021 CET	443	49763	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.700630903 CET	443	49758	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.700867891 CET	443	49758	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.700930119 CET	49758	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.700970888 CET	49758	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.700990915 CET	443	49758	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.701003075 CET	49758	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.701009035 CET	443	49758	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.701463938 CET	443	49760	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.701617956 CET	443	49760	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.701683044 CET	49760	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.701797009 CET	49760	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.701797009 CET	49760	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.701838970 CET	443	49760	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.701869011 CET	443	49760	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.703248978 CET	443	49759	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.703368902 CET	443	49759	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.703424931 CET	49759	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.703443050 CET	49759	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.703458071 CET	443	49759	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.703468084 CET	49759	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.703471899 CET	443	49759	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.703913927 CET	49764	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.703968048 CET	443	49764	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.704030037 CET	49764	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.704178095 CET	49764	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.704200029 CET	443	49764	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.704412937 CET	49765	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.704444885 CET	443	49765	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.704493999 CET	49765	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.704590082 CET	49765	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.704602003 CET	443	49765	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.705405951 CET	49766	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.705441952 CET	443	49766	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.705503941 CET	49766	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.705625057 CET	49766	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.705642939 CET	443	49766	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.714481115 CET	443	49762	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.714963913 CET	49762	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.714979887 CET	443	49762	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.715456963 CET	49762	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.715464115 CET	443	49762	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.855074883 CET	443	49762	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.855202913 CET	443	49762	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.855259895 CET	49762	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.855416059 CET	49762	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.855437040 CET	443	49762	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.855448008 CET	49762	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.855453014 CET	443	49762	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.858532906 CET	49767	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.858575106 CET	443	49767	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:10.858654022 CET	49767	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.858803988 CET	49767	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:10.858810902 CET	443	49767	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.454673052 CET	443	49764	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.455212116 CET	49764	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.455240965 CET	443	49764	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.455677032 CET	49764	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.455682039 CET	443	49764	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.456557035 CET	443	49763	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.456825972 CET	49763	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.456852913 CET	443	49763	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.457261086 CET	49763	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.457264900 CET	443	49763	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.459832907 CET	443	49766	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.460216045 CET	49766	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.460222960 CET	443	49766	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.460652113 CET	49766	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.460658073 CET	443	49766	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.464153051 CET	443	49765	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.464570999 CET	49765	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.464596987 CET	443	49765	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.464961052 CET	49765	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.464965105 CET	443	49765	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.588274956 CET	443	49764	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.588824987 CET	443	49764	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.588892937 CET	49764	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.588932991 CET	49764	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.588954926 CET	443	49764	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.588968992 CET	49764	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.588974953 CET	443	49764	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.591408968 CET	443	49766	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.591845989 CET	443	49766	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.591927052 CET	49766	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.591959000 CET	49766	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.591964006 CET	443	49766	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.591990948 CET	49766	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.591995001 CET	443	49766	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.592652082 CET	49768	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.592688084 CET	443	49768	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.592767000 CET	49768	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.592993975 CET	49768	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.593009949 CET	443	49768	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.594465017 CET	49769	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.594582081 CET	443	49769	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.594670057 CET	49769	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.594809055 CET	49769	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.594844103 CET	443	49769	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.596132994 CET	443	49763	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.596393108 CET	443	49763	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.596452951 CET	49763	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.596486092 CET	49763	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.596503973 CET	443	49763	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.596513987 CET	49763	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.596525908 CET	443	49763	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.597440958 CET	443	49767	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.598000050 CET	49767	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.598064899 CET	443	49767	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.598548889 CET	49767	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.598566055 CET	443	49767	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.598953009 CET	49770	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.598984957 CET	443	49770	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.599104881 CET	49770	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.599205017 CET	49770	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.599220991 CET	443	49770	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.601655960 CET	443	49765	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.601710081 CET	443	49765	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.601819992 CET	49765	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.601891041 CET	49765	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.601891041 CET	49765	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.601928949 CET	443	49765	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.601937056 CET	443	49765	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.603849888 CET	49771	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.603877068 CET	443	49771	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.603971004 CET	49771	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.604104042 CET	49771	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.604130983 CET	443	49771	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.731126070 CET	443	49767	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.731296062 CET	443	49767	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.731390953 CET	49767	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.731587887 CET	49767	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.731610060 CET	443	49767	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.731625080 CET	49767	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.731630087 CET	443	49767	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.734384060 CET	49772	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.734422922 CET	443	49772	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:11.734628916 CET	49772	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.734628916 CET	49772	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:11.734662056 CET	443	49772	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.348634958 CET	443	49770	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.348891973 CET	443	49768	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.351701975 CET	49770	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.351725101 CET	443	49770	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.352063894 CET	49768	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.352077007 CET	443	49768	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.352308035 CET	49770	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.352318048 CET	443	49770	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.352823973 CET	49768	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.352828026 CET	443	49768	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.354110956 CET	443	49769	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.357537985 CET	49769	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.357578993 CET	443	49769	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.357958078 CET	49769	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.357966900 CET	443	49769	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.368846893 CET	443	49771	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.369528055 CET	49771	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.369551897 CET	443	49771	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.370008945 CET	49771	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.370016098 CET	443	49771	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.401585102 CET	80	49716	193.122.6.168	192.168.2.7
Oct 31, 2024 11:00:12.402090073 CET	49716	80	192.168.2.7	193.122.6.168
Oct 31, 2024 11:00:12.482601881 CET	443	49770	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.482714891 CET	443	49770	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.482769012 CET	49770	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.482937098 CET	49770	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.482937098 CET	49770	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.482954025 CET	443	49770	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.482961893 CET	443	49770	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.485837936 CET	49773	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.485888958 CET	443	49773	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.485963106 CET	49773	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.486105919 CET	443	49768	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.486165047 CET	49773	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.486177921 CET	443	49773	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.486465931 CET	443	49768	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.486519098 CET	49768	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.486629963 CET	49768	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.486629963 CET	49768	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.486635923 CET	443	49768	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.486644030 CET	443	49768	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.488755941 CET	49774	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.488795996 CET	443	49774	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.488933086 CET	49774	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.489084005 CET	49774	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.489098072 CET	443	49774	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.490649939 CET	443	49769	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.490803957 CET	443	49769	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.490868092 CET	49769	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.490948915 CET	49769	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.490948915 CET	49769	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.490998983 CET	443	49769	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.491029978 CET	443	49769	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.493010044 CET	49775	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.493041992 CET	443	49775	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.493099928 CET	49775	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.493240118 CET	49775	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.493252039 CET	443	49775	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.499280930 CET	443	49772	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.499808073 CET	49772	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.499816895 CET	443	49772	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.500255108 CET	49772	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.500258923 CET	443	49772	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.508215904 CET	443	49771	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.508495092 CET	443	49771	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.508544922 CET	49771	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.508591890 CET	49771	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.508591890 CET	49771	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.508613110 CET	443	49771	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.508637905 CET	443	49771	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.510575056 CET	49776	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.510622978 CET	443	49776	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.510711908 CET	49776	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.510842085 CET	49776	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.510867119 CET	443	49776	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.636356115 CET	443	49772	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.636431932 CET	443	49772	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.636501074 CET	49772	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.636737108 CET	49772	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.636761904 CET	443	49772	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.636776924 CET	49772	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.636782885 CET	443	49772	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.639626026 CET	49777	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.639676094 CET	443	49777	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:12.639813900 CET	49777	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.639921904 CET	49777	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:12.639934063 CET	443	49777	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.408257961 CET	443	49773	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.408260107 CET	443	49777	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.409740925 CET	443	49776	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.410026073 CET	443	49775	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.410136938 CET	443	49774	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.414700985 CET	49774	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.414714098 CET	443	49774	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.415783882 CET	49774	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.415788889 CET	443	49774	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.416435003 CET	49775	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.416449070 CET	443	49775	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.417191029 CET	49775	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.417196989 CET	443	49775	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.417973042 CET	49773	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.417979956 CET	443	49773	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.418590069 CET	49773	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.418595076 CET	443	49773	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.419012070 CET	49777	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.419023991 CET	443	49777	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.419641972 CET	49777	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.419647932 CET	443	49777	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.420053005 CET	49776	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.420079947 CET	443	49776	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.420677900 CET	49776	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.420681953 CET	443	49776	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.548401117 CET	443	49775	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.548557043 CET	443	49775	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.548585892 CET	443	49774	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.548660994 CET	49775	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.548772097 CET	443	49774	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.548816919 CET	49774	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.548949957 CET	49775	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.548960924 CET	49774	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.548974991 CET	443	49775	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.548978090 CET	443	49774	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.548989058 CET	49775	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.548995018 CET	443	49775	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.549004078 CET	49774	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.549010038 CET	443	49774	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.552117109 CET	49779	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.552123070 CET	49778	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.552160025 CET	443	49779	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.552170992 CET	443	49778	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.552237988 CET	49779	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.552355051 CET	443	49773	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.552367926 CET	49778	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.552367926 CET	49778	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.552400112 CET	443	49778	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.552464008 CET	49779	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.552478075 CET	443	49779	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.552709103 CET	443	49773	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.552763939 CET	49773	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.552793980 CET	49773	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.552809954 CET	443	49773	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.552823067 CET	49773	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.552828074 CET	443	49773	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.553035975 CET	443	49777	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.553495884 CET	443	49777	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.553544998 CET	49777	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.553653002 CET	49777	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.553668022 CET	443	49777	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.553678989 CET	49777	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.553684950 CET	443	49777	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.555460930 CET	49780	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.555495977 CET	443	49780	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.555557013 CET	49781	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.555558920 CET	49780	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.555578947 CET	443	49781	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.555619955 CET	49781	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.555670023 CET	49780	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.555680037 CET	443	49780	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.555777073 CET	49781	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.555787086 CET	443	49781	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.565026045 CET	443	49776	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.565284967 CET	443	49776	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.569191933 CET	49776	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.569243908 CET	49776	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.569258928 CET	443	49776	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.569274902 CET	49776	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.569279909 CET	443	49776	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.571758986 CET	49782	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.571799994 CET	443	49782	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:14.571868896 CET	49782	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.571995974 CET	49782	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:14.572006941 CET	443	49782	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.313740015 CET	443	49781	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.315726042 CET	49781	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.315753937 CET	443	49781	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.316144943 CET	49781	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.316150904 CET	443	49781	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.328656912 CET	443	49782	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.330535889 CET	49782	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.330557108 CET	443	49782	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.331002951 CET	49782	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.331016064 CET	443	49782	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.332420111 CET	443	49780	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.332667112 CET	49780	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.332679987 CET	443	49780	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.333002090 CET	49780	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.333009958 CET	443	49780	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.336960077 CET	443	49778	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.337249041 CET	49778	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.337310076 CET	443	49778	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.337562084 CET	49778	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.337578058 CET	443	49778	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.340497017 CET	443	49779	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.344417095 CET	49779	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.344441891 CET	443	49779	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.344846010 CET	49779	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.344854116 CET	443	49779	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.453490973 CET	443	49781	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.453697920 CET	443	49781	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.453833103 CET	49781	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.455718040 CET	49781	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.455718040 CET	49781	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.455739975 CET	443	49781	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.455749989 CET	443	49781	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.467185974 CET	443	49782	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.467602968 CET	443	49782	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.467714071 CET	49782	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.469101906 CET	49782	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.469134092 CET	443	49782	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.469141006 CET	49782	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.469146967 CET	443	49782	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.475667953 CET	443	49780	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.476044893 CET	443	49780	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.476136923 CET	49780	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.477324009 CET	49780	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.477343082 CET	443	49780	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.477356911 CET	49780	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.477361917 CET	443	49780	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.478331089 CET	443	49778	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.478482962 CET	443	49778	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.478545904 CET	49778	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.479649067 CET	80	49722	193.122.6.168	192.168.2.7
Oct 31, 2024 11:00:15.479829073 CET	49722	80	192.168.2.7	193.122.6.168
Oct 31, 2024 11:00:15.483175993 CET	443	49779	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.483412027 CET	443	49779	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.483586073 CET	49779	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.490597963 CET	49783	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.490629911 CET	443	49783	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.490716934 CET	49783	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.494292974 CET	49778	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.494313955 CET	443	49778	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.494349003 CET	49778	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.494355917 CET	443	49778	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.502523899 CET	49779	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.502523899 CET	49779	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.502578974 CET	443	49779	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.502593994 CET	443	49779	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.510945082 CET	49783	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.510967970 CET	443	49783	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.526798010 CET	49784	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.526853085 CET	443	49784	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.529216051 CET	49784	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.535700083 CET	49785	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.535792112 CET	443	49785	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.535912991 CET	49785	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.539649963 CET	49784	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.539679050 CET	443	49784	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.548209906 CET	49786	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.548244953 CET	443	49786	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.548379898 CET	49786	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.552175045 CET	49786	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.552194118 CET	443	49786	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.552418947 CET	49785	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.552465916 CET	443	49785	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.564517021 CET	49787	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.564574003 CET	443	49787	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:15.564677954 CET	49787	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.568334103 CET	49787	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:15.568360090 CET	443	49787	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.272814989 CET	443	49783	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.273533106 CET	49783	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.273544073 CET	443	49783	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.274039984 CET	49783	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.274048090 CET	443	49783	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.298557043 CET	443	49784	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.299056053 CET	49784	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.299088955 CET	443	49784	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.299494028 CET	49784	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.299503088 CET	443	49784	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.301027060 CET	443	49786	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.301486015 CET	49786	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.301510096 CET	443	49786	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.301963091 CET	49786	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.301970005 CET	443	49786	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.315677881 CET	443	49785	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.316147089 CET	49785	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.316174030 CET	443	49785	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.316540956 CET	49785	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.316546917 CET	443	49785	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.318943977 CET	443	49787	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.319399118 CET	49787	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.319407940 CET	443	49787	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.320071936 CET	49787	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.320076942 CET	443	49787	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.417331934 CET	443	49783	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.417427063 CET	443	49783	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.417478085 CET	49783	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.417711973 CET	49783	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.417733908 CET	443	49783	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.417746067 CET	49783	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.417752981 CET	443	49783	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.420752048 CET	49788	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.420814991 CET	443	49788	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.420890093 CET	49788	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.421040058 CET	49788	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.421056032 CET	443	49788	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.436307907 CET	443	49784	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.436451912 CET	443	49784	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.436511040 CET	49784	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.436609983 CET	49784	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.436631918 CET	443	49784	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.436650038 CET	49784	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.436657906 CET	443	49784	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.438828945 CET	443	49786	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.438884974 CET	443	49786	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.438936949 CET	49786	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.439390898 CET	49786	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.439403057 CET	443	49786	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.439424992 CET	49786	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.439430952 CET	443	49786	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.439604998 CET	49789	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.439656019 CET	443	49789	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.439707994 CET	49789	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.440126896 CET	49789	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.440143108 CET	443	49789	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.441847086 CET	49790	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.441883087 CET	443	49790	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.441981077 CET	49790	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.442317963 CET	49790	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.442332983 CET	443	49790	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.453161955 CET	443	49785	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.453319073 CET	443	49785	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.453387976 CET	49785	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.453489065 CET	49785	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.453509092 CET	443	49785	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.453522921 CET	49785	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.453530073 CET	443	49785	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.456909895 CET	49791	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.456981897 CET	443	49791	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.457061052 CET	49791	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.457321882 CET	49791	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.457348108 CET	443	49791	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.458257914 CET	443	49787	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.458353043 CET	443	49787	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.458406925 CET	49787	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.458542109 CET	49787	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.458554983 CET	443	49787	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.458571911 CET	49787	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.458576918 CET	443	49787	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.461236000 CET	49792	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.461272955 CET	443	49792	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:16.461348057 CET	49792	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.461601973 CET	49792	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:16.461621046 CET	443	49792	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.172143936 CET	443	49788	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.188601971 CET	443	49789	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.203141928 CET	443	49790	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.216372967 CET	49788	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.218105078 CET	49788	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.218132019 CET	443	49788	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.218239069 CET	49789	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.218276024 CET	443	49789	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.218647003 CET	49788	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.218656063 CET	443	49788	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.218779087 CET	49789	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.218786001 CET	443	49789	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.218926907 CET	49790	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.218936920 CET	443	49790	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.219309092 CET	49790	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.219322920 CET	443	49790	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.234877110 CET	443	49792	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.235414028 CET	49792	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.235447884 CET	443	49792	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.235884905 CET	49792	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.235894918 CET	443	49792	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.240658045 CET	443	49791	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.241111040 CET	49791	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.241127968 CET	443	49791	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.241523027 CET	49791	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.241532087 CET	443	49791	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.350795984 CET	443	49789	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.350805044 CET	443	49788	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.351031065 CET	443	49789	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.351119995 CET	49789	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.351212025 CET	49789	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.351231098 CET	443	49789	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.351241112 CET	49789	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.351247072 CET	443	49789	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.352201939 CET	443	49788	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.352257967 CET	49788	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.352338076 CET	49788	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.352364063 CET	443	49788	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.352382898 CET	49788	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.352390051 CET	443	49788	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.354219913 CET	49793	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.354258060 CET	443	49793	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.354330063 CET	49793	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.354427099 CET	49794	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.354476929 CET	443	49794	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.354491949 CET	49793	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.354501963 CET	443	49793	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.354530096 CET	49794	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.354531050 CET	443	49790	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.354609966 CET	443	49790	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.354655981 CET	49790	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.354682922 CET	49794	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.354697943 CET	443	49794	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.354707956 CET	49790	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.354721069 CET	443	49790	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.354732990 CET	49790	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.354737997 CET	443	49790	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.356838942 CET	49795	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.356848955 CET	443	49795	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.356914997 CET	49795	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.357026100 CET	49795	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.357036114 CET	443	49795	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.373176098 CET	443	49792	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.373265028 CET	443	49792	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.373339891 CET	49792	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.373615980 CET	49792	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.373646975 CET	443	49792	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.373663902 CET	49792	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.373672009 CET	443	49792	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.376482010 CET	49796	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.376543999 CET	443	49796	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.376627922 CET	49796	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.376796961 CET	49796	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.376807928 CET	443	49796	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.378256083 CET	443	49791	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.379059076 CET	443	49791	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.379112005 CET	49791	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.379149914 CET	49791	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.379165888 CET	443	49791	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.379172087 CET	49791	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.379177094 CET	443	49791	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.381081104 CET	49797	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.381103992 CET	443	49797	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:17.381160975 CET	49797	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.381273985 CET	49797	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:17.381284952 CET	443	49797	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.102282047 CET	443	49793	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.102745056 CET	49793	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.102763891 CET	443	49793	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.103213072 CET	49793	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.103221893 CET	443	49793	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.104029894 CET	443	49794	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.111404896 CET	49794	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.111438036 CET	443	49794	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.111819029 CET	49794	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.111829042 CET	443	49794	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.118670940 CET	443	49795	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.124486923 CET	49795	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.124545097 CET	443	49795	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.128662109 CET	49795	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.128681898 CET	443	49795	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.136883020 CET	443	49796	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.141171932 CET	49796	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.141205072 CET	443	49796	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.141592026 CET	49796	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.141599894 CET	443	49796	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.142642021 CET	443	49797	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.145453930 CET	49797	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.145473957 CET	443	49797	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.149271965 CET	49797	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.149276972 CET	443	49797	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.237247944 CET	443	49793	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.237535000 CET	443	49793	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.237684965 CET	49793	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.248517036 CET	443	49794	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.248828888 CET	443	49794	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.248903036 CET	49794	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.263207912 CET	443	49795	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.263283968 CET	443	49795	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.263390064 CET	49795	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.274764061 CET	443	49796	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.274899006 CET	443	49796	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.275033951 CET	49796	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.283529997 CET	443	49797	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.283708096 CET	443	49797	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.283821106 CET	49797	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.343993902 CET	49793	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.344043016 CET	443	49793	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.344082117 CET	49793	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.344089031 CET	443	49793	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.345079899 CET	49796	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.345081091 CET	49796	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.345145941 CET	443	49796	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.345177889 CET	443	49796	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.346841097 CET	49797	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.346879005 CET	443	49797	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.346894979 CET	49797	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.346901894 CET	443	49797	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.347541094 CET	49794	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.347541094 CET	49794	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.347600937 CET	443	49794	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.347630978 CET	443	49794	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.348237038 CET	49795	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.348259926 CET	443	49795	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.353838921 CET	49798	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.353930950 CET	443	49798	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.354017973 CET	49798	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.354392052 CET	49799	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.354414940 CET	443	49799	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.354465008 CET	49799	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.354640961 CET	49800	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.354737043 CET	443	49800	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.354883909 CET	49800	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.357899904 CET	49801	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.357939005 CET	443	49801	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.358031988 CET	49801	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.358227968 CET	49801	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.358246088 CET	443	49801	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.358340979 CET	49798	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.358377934 CET	443	49798	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.358403921 CET	49799	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.358418941 CET	443	49799	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.359252930 CET	49802	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.359285116 CET	443	49802	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.359357119 CET	49802	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.359452963 CET	49802	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.359478951 CET	443	49802	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:18.359576941 CET	49800	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:18.359589100 CET	443	49800	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.107713938 CET	443	49798	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.108270884 CET	49798	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.108361006 CET	443	49798	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.108772039 CET	49798	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.108788013 CET	443	49798	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.114159107 CET	443	49802	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.114588022 CET	49802	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.114629984 CET	443	49802	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.115008116 CET	49802	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.115015030 CET	443	49802	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.118851900 CET	443	49799	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.119247913 CET	49799	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.119276047 CET	443	49799	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.119648933 CET	49799	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.119653940 CET	443	49799	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.122482061 CET	443	49801	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.122854948 CET	49801	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.122873068 CET	443	49801	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.123233080 CET	49801	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.123238087 CET	443	49801	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.127948999 CET	443	49800	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.128278971 CET	49800	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.128288984 CET	443	49800	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.128669977 CET	49800	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.128675938 CET	443	49800	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.244007111 CET	443	49798	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.244218111 CET	443	49798	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.244339943 CET	49798	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.244478941 CET	49798	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.244524002 CET	443	49798	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.244551897 CET	49798	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.244568110 CET	443	49798	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.248188019 CET	49803	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.248220921 CET	443	49803	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.248492002 CET	49803	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.248610973 CET	49803	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.248622894 CET	443	49803	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.252011061 CET	443	49802	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.252074957 CET	443	49802	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.252125025 CET	49802	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.252240896 CET	49802	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.252264023 CET	443	49802	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.252280951 CET	49802	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.252286911 CET	443	49802	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.254440069 CET	49804	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.254470110 CET	443	49804	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.254564047 CET	49804	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.254693031 CET	49804	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.254703999 CET	443	49804	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.256902933 CET	443	49799	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.256956100 CET	443	49799	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.257044077 CET	49799	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.257085085 CET	49799	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.257097006 CET	443	49799	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.257107973 CET	49799	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.257112980 CET	443	49799	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.258841038 CET	49805	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.258871078 CET	443	49805	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.258963108 CET	49805	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.259206057 CET	49805	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.259216070 CET	443	49805	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.259789944 CET	443	49801	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.259860992 CET	443	49801	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.259970903 CET	49801	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.259970903 CET	49801	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.260042906 CET	49801	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.260050058 CET	443	49801	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.262259007 CET	49806	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.262284040 CET	443	49806	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.262341976 CET	49806	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.262470007 CET	49806	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.262478113 CET	443	49806	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.263751030 CET	443	49800	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.264154911 CET	443	49800	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.264199018 CET	49800	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.264230967 CET	49800	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.264239073 CET	443	49800	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.264252901 CET	49800	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.264257908 CET	443	49800	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.266052008 CET	49807	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.266063929 CET	443	49807	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.266299963 CET	49807	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.266402960 CET	49807	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.266416073 CET	443	49807	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.989736080 CET	443	49803	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.990643978 CET	49803	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.990665913 CET	443	49803	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:19.990864992 CET	49803	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:19.990869999 CET	443	49803	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.006757975 CET	443	49807	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.007530928 CET	49807	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.007555008 CET	443	49807	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.007909060 CET	49807	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.007920980 CET	443	49807	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.011976004 CET	443	49806	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.012554884 CET	49806	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.012583971 CET	443	49806	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.012978077 CET	49806	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.012983084 CET	443	49806	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.019520998 CET	443	49804	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.020003080 CET	49804	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.020014048 CET	443	49804	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.020431995 CET	49804	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.020437956 CET	443	49804	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.020593882 CET	443	49805	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.020858049 CET	49805	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.020889044 CET	443	49805	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.021210909 CET	49805	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.021250010 CET	443	49805	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.124186993 CET	443	49803	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.124524117 CET	443	49803	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.124574900 CET	49803	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.124639988 CET	49803	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.124660969 CET	443	49803	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.124676943 CET	49803	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.124682903 CET	443	49803	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.128004074 CET	49808	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.128050089 CET	443	49808	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.128114939 CET	49808	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.128288984 CET	49808	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.128299952 CET	443	49808	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.141305923 CET	443	49807	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.141428947 CET	443	49807	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.141482115 CET	49807	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.141609907 CET	49807	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.141628981 CET	443	49807	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.141644001 CET	49807	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.141650915 CET	443	49807	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.144457102 CET	49809	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.144521952 CET	443	49809	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.144594908 CET	49809	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.144745111 CET	49809	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.144759893 CET	443	49809	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.147735119 CET	443	49806	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.147814035 CET	443	49806	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.147869110 CET	49806	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.148077011 CET	49806	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.148096085 CET	443	49806	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.148109913 CET	49806	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.148116112 CET	443	49806	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.150696039 CET	49810	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.150734901 CET	443	49810	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.150810003 CET	49810	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.150949001 CET	49810	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.150969982 CET	443	49810	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.158189058 CET	443	49804	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.158283949 CET	443	49804	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.158343077 CET	49804	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.158416986 CET	49804	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.158432007 CET	443	49804	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.158443928 CET	49804	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.158451080 CET	443	49804	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.160773039 CET	49811	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.160806894 CET	443	49811	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.160866022 CET	49811	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.161030054 CET	49811	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.161041975 CET	443	49811	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.167908907 CET	443	49805	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.168324947 CET	443	49805	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.168376923 CET	49805	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.168416023 CET	49805	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.168427944 CET	443	49805	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.168441057 CET	49805	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.168446064 CET	443	49805	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.170411110 CET	49812	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.170433998 CET	443	49812	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.170485973 CET	49812	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.170610905 CET	49812	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.170620918 CET	443	49812	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.871866941 CET	443	49808	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.903951883 CET	443	49811	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.904269934 CET	443	49810	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.910384893 CET	443	49809	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.917406082 CET	49808	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.936872959 CET	443	49812	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.942504883 CET	49812	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.942518950 CET	443	49812	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.946376085 CET	49812	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.946383953 CET	443	49812	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.948618889 CET	49810	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.948628902 CET	49811	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.950844049 CET	49809	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.950864077 CET	443	49809	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.951245070 CET	49809	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.951252937 CET	443	49809	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.951463938 CET	49808	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.951473951 CET	443	49808	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.951802015 CET	49808	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.951808929 CET	443	49808	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.951982021 CET	49811	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.951991081 CET	443	49811	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.952327967 CET	49811	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.952334881 CET	443	49811	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.952502012 CET	49810	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.952507973 CET	443	49810	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:20.952827930 CET	49810	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:20.952832937 CET	443	49810	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.083988905 CET	443	49811	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.084055901 CET	443	49811	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.084238052 CET	49811	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.084322929 CET	49811	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.084322929 CET	49811	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.084367037 CET	443	49811	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.084379911 CET	443	49811	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.084553957 CET	443	49810	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.084779978 CET	443	49810	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.084876060 CET	49810	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.085735083 CET	49810	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.085736036 CET	49810	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.085757971 CET	443	49810	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.085762978 CET	443	49810	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.085781097 CET	443	49812	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.086122990 CET	443	49812	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.087971926 CET	443	49809	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.088047028 CET	49812	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.088099003 CET	443	49809	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.088148117 CET	49809	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.089560032 CET	49809	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.089560032 CET	49809	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.089579105 CET	443	49809	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.089586973 CET	443	49809	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.090684891 CET	443	49808	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.090722084 CET	443	49808	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.090790033 CET	49808	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.093539953 CET	49808	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.093539953 CET	49808	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.093549967 CET	443	49808	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.093558073 CET	443	49808	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.097816944 CET	49812	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.097846985 CET	443	49812	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.097858906 CET	49812	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.097866058 CET	443	49812	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.110145092 CET	49813	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.110178947 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.110467911 CET	49813	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.110960007 CET	49813	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.110969067 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.113601923 CET	49814	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.113636971 CET	443	49814	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.113745928 CET	49814	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.117100954 CET	49814	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.117121935 CET	443	49814	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.121598005 CET	49815	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.121611118 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.121692896 CET	49815	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.122294903 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.122378111 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.125204086 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.126187086 CET	49817	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.126228094 CET	443	49817	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.126909018 CET	49815	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.126919031 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.126943111 CET	49817	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.127038956 CET	49817	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.127058983 CET	443	49817	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.134485006 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.134536982 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.882277966 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.882344961 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.882541895 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.882904053 CET	49815	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.882904053 CET	49813	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.882931948 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.882944107 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.883402109 CET	49815	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.883407116 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.883434057 CET	49813	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.883438110 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.883723974 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.883740902 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.884107113 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.884111881 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.908519983 CET	443	49814	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.909181118 CET	49814	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.909194946 CET	443	49814	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.909738064 CET	49814	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.909744024 CET	443	49814	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.917619944 CET	443	49817	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.918065071 CET	49817	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.918118954 CET	443	49817	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:21.918525934 CET	49817	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:21.918540001 CET	443	49817	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.017539024 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.017561913 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.017616034 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.017632961 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.017646074 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.017679930 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.017694950 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.017750025 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.017765999 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.017806053 CET	49815	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.017812967 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.017899036 CET	49815	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.018035889 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.018050909 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.018062115 CET	49816	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.018066883 CET	443	49816	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.019674063 CET	49815	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.019674063 CET	49815	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.019702911 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.019714117 CET	443	49815	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.022938013 CET	49818	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.022957087 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.023009062 CET	49818	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.024247885 CET	49819	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.024291992 CET	443	49819	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.024344921 CET	49819	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.024535894 CET	49818	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.024544001 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.024673939 CET	49819	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.024691105 CET	443	49819	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.037791014 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.037806988 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.037847042 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.037887096 CET	49813	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.037915945 CET	49813	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.038111925 CET	49813	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.038125992 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.038141012 CET	49813	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.038146019 CET	443	49813	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.041083097 CET	49820	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.041121960 CET	443	49820	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.041202068 CET	49820	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.041371107 CET	49820	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.041388988 CET	443	49820	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.044503927 CET	443	49814	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.044575930 CET	443	49814	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.044651031 CET	49814	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.044722080 CET	49814	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.044722080 CET	49814	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.044737101 CET	443	49814	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.044742107 CET	443	49814	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.047722101 CET	49821	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.047808886 CET	443	49821	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.047889948 CET	49821	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.048044920 CET	49821	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.048080921 CET	443	49821	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.062237978 CET	443	49817	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.062370062 CET	443	49817	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.062432051 CET	49817	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.063359022 CET	49817	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.063390017 CET	443	49817	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.063419104 CET	49817	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.063431978 CET	443	49817	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.071193933 CET	49822	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.071224928 CET	443	49822	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.071288109 CET	49822	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.071492910 CET	49822	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.071508884 CET	443	49822	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.760814905 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.761965036 CET	49818	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.761982918 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.765194893 CET	49818	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.765202045 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.780807018 CET	443	49820	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.781457901 CET	49820	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.781487942 CET	443	49820	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.781927109 CET	49820	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.781933069 CET	443	49820	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.786545992 CET	443	49819	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.787137032 CET	49819	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.787175894 CET	443	49819	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.789185047 CET	49819	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.789194107 CET	443	49819	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.792758942 CET	443	49821	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.793272018 CET	49821	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.793303967 CET	443	49821	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.795252085 CET	49821	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.795260906 CET	443	49821	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.822076082 CET	443	49822	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.822659016 CET	49822	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.822680950 CET	443	49822	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.823132992 CET	49822	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.823141098 CET	443	49822	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.894444942 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.894468069 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.894515991 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.894587040 CET	49818	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.894587040 CET	49818	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.894783020 CET	49818	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.894795895 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.894824028 CET	49818	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.894829035 CET	443	49818	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.898083925 CET	49823	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.898134947 CET	443	49823	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.898305893 CET	49823	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.898391962 CET	49823	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.898406982 CET	443	49823	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.915700912 CET	443	49820	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.916328907 CET	443	49820	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.916461945 CET	49820	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.916639090 CET	49820	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.916639090 CET	49820	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.916657925 CET	443	49820	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.916666031 CET	443	49820	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.921176910 CET	49824	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.921209097 CET	443	49824	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.921320915 CET	49824	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.921612978 CET	49824	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.921626091 CET	443	49824	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.925831079 CET	443	49819	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.925883055 CET	443	49819	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.925975084 CET	49819	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.926093102 CET	49819	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.926115990 CET	443	49819	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.928374052 CET	443	49821	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.928435087 CET	443	49821	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.928569078 CET	49821	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.928694010 CET	49825	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.928740025 CET	443	49825	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.928755999 CET	49821	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.928755999 CET	49821	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.928776979 CET	443	49821	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.928783894 CET	443	49821	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.928894043 CET	49825	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.929127932 CET	49825	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.929145098 CET	443	49825	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.933100939 CET	49826	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.933146954 CET	443	49826	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.933443069 CET	49826	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.933727980 CET	49826	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.933749914 CET	443	49826	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.972142935 CET	443	49822	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.972361088 CET	443	49822	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.972472906 CET	49822	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.972472906 CET	49822	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.972536087 CET	49822	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.972549915 CET	443	49822	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.975897074 CET	49827	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.975944042 CET	443	49827	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:22.976052999 CET	49827	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.976238966 CET	49827	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:22.976255894 CET	443	49827	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.552026987 CET	80	49734	193.122.6.168	192.168.2.7
Oct 31, 2024 11:00:23.552122116 CET	49734	80	192.168.2.7	193.122.6.168
Oct 31, 2024 11:00:23.648700953 CET	443	49823	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.649384022 CET	49823	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.649408102 CET	443	49823	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.650074959 CET	49823	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.650082111 CET	443	49823	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.665358067 CET	443	49824	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.666017056 CET	49824	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.666033030 CET	443	49824	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.666646004 CET	49824	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.666651964 CET	443	49824	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.687532902 CET	443	49825	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.688206911 CET	49825	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.688283920 CET	443	49825	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.688772917 CET	49825	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.688791037 CET	443	49825	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.693661928 CET	443	49826	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.694068909 CET	49826	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.694081068 CET	443	49826	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.694582939 CET	49826	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.694587946 CET	443	49826	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.731859922 CET	443	49827	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.732423067 CET	49827	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.732448101 CET	443	49827	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.732949972 CET	49827	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.732961893 CET	443	49827	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.785317898 CET	443	49823	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.785399914 CET	443	49823	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.785485983 CET	49823	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.785657883 CET	49823	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.785684109 CET	443	49823	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.785698891 CET	49823	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.785706997 CET	443	49823	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.789144993 CET	49828	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.789190054 CET	443	49828	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.789258003 CET	49828	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.789427996 CET	49828	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.789446115 CET	443	49828	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.805527925 CET	443	49824	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.805573940 CET	443	49824	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.805670977 CET	49824	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.805923939 CET	49824	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.805923939 CET	49824	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.805953026 CET	443	49824	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.805963993 CET	443	49824	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.809461117 CET	49829	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.809488058 CET	443	49829	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.809547901 CET	49829	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.809768915 CET	49829	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.809782028 CET	443	49829	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.824594975 CET	443	49825	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.824774027 CET	443	49825	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.824852943 CET	49825	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.824924946 CET	49825	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.824963093 CET	443	49825	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.824978113 CET	49825	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.824992895 CET	443	49825	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.828416109 CET	49830	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.828443050 CET	443	49830	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.828509092 CET	49830	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.828722954 CET	49830	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.828736067 CET	443	49830	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.840351105 CET	443	49826	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.840415955 CET	443	49826	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.840507984 CET	49826	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.840667963 CET	49826	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.840684891 CET	443	49826	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.840697050 CET	49826	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.840702057 CET	443	49826	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.844094038 CET	49831	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.844119072 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.844254971 CET	49831	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.844391108 CET	49831	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.844400883 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.867559910 CET	443	49827	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.867649078 CET	443	49827	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.867712975 CET	49827	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.868016005 CET	49827	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.868041992 CET	443	49827	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.868067980 CET	49827	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.868079901 CET	443	49827	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.871666908 CET	49832	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.871686935 CET	443	49832	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:23.871906996 CET	49832	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.871906996 CET	49832	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:23.871931076 CET	443	49832	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.568772078 CET	443	49829	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.569363117 CET	49829	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.569375992 CET	443	49829	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.569927931 CET	49829	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.569932938 CET	443	49829	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.571208000 CET	443	49828	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.571547985 CET	49828	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.571563959 CET	443	49828	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.572037935 CET	49828	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.572043896 CET	443	49828	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.572721958 CET	443	49830	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.573093891 CET	49830	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.573106050 CET	443	49830	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.573649883 CET	49830	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.573656082 CET	443	49830	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.607554913 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.609662056 CET	49831	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.609671116 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.610146999 CET	49831	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.610152006 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.624929905 CET	443	49832	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.627609968 CET	49832	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.627629995 CET	443	49832	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.628091097 CET	49832	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.628098011 CET	443	49832	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.706332922 CET	443	49829	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.706576109 CET	443	49829	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.706624985 CET	443	49829	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.706748009 CET	49829	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.706748009 CET	49829	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.706840038 CET	49829	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.706852913 CET	443	49829	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.712243080 CET	49833	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.712299109 CET	443	49833	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.712416887 CET	49833	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.712629080 CET	49833	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.712645054 CET	443	49833	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.712800026 CET	443	49828	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.712865114 CET	443	49828	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.713114023 CET	49828	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.713114023 CET	49828	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.713114023 CET	49828	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.715337038 CET	49834	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.715364933 CET	443	49834	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.715451002 CET	49834	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.720794916 CET	443	49830	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.720833063 CET	49834	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.720839977 CET	443	49834	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.721256018 CET	443	49830	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.724272013 CET	49830	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.724272013 CET	49830	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.724303961 CET	49830	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.724317074 CET	443	49830	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.726433992 CET	49835	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.726454973 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.727049112 CET	49835	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.727179050 CET	49835	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.727202892 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.746423960 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.746499062 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.746532917 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.746643066 CET	49831	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.746756077 CET	49831	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.746756077 CET	49831	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.746763945 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.746772051 CET	443	49831	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.749180079 CET	49836	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.749221087 CET	443	49836	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.749315023 CET	49836	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.749526024 CET	49836	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.749541044 CET	443	49836	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.765950918 CET	443	49832	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.766309977 CET	443	49832	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.766486883 CET	49832	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.766694069 CET	49832	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.766694069 CET	49832	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.766704082 CET	443	49832	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.766712904 CET	443	49832	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.768855095 CET	49837	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.768893003 CET	443	49837	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.769061089 CET	49837	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.769143105 CET	49837	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.769151926 CET	443	49837	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:24.917424917 CET	49828	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:24.917448997 CET	443	49828	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.464193106 CET	443	49834	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.468000889 CET	49834	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.468008995 CET	443	49834	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.468633890 CET	49834	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.468637943 CET	443	49834	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.475141048 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.475646973 CET	49835	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.475673914 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.476114035 CET	49835	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.476126909 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.500899076 CET	443	49836	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.504537106 CET	443	49833	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.504755020 CET	49836	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.504779100 CET	443	49836	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.505362988 CET	49836	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.505376101 CET	443	49836	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.505413055 CET	49833	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.505436897 CET	443	49833	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.505954027 CET	49833	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.505968094 CET	443	49833	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.521614075 CET	443	49837	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.522525072 CET	49837	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.522545099 CET	443	49837	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.522808075 CET	49837	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.522814035 CET	443	49837	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.600954056 CET	443	49834	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.601021051 CET	443	49834	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.601097107 CET	49834	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.601824999 CET	49834	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.601840019 CET	443	49834	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.601851940 CET	49834	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.601856947 CET	443	49834	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.607768059 CET	49838	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.607803106 CET	443	49838	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.607875109 CET	49838	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.608527899 CET	49838	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.608544111 CET	443	49838	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.612341881 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.612377882 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.612421989 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.612437963 CET	49835	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.612477064 CET	49835	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.612662077 CET	49835	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.612662077 CET	49835	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.612685919 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.612709045 CET	443	49835	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.617697001 CET	49839	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.617712975 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.617769957 CET	49839	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.621964931 CET	49839	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.621974945 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.641213894 CET	443	49836	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.641521931 CET	443	49836	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.641570091 CET	49836	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.641613007 CET	49836	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.641628981 CET	443	49836	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.645828962 CET	49840	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.645885944 CET	443	49840	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.645953894 CET	49840	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.646133900 CET	49840	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.646183014 CET	443	49840	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.648159027 CET	443	49833	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.648628950 CET	443	49833	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.648683071 CET	49833	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.648984909 CET	49833	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.649003029 CET	443	49833	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.653091908 CET	49841	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.653120041 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.653171062 CET	49841	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.653490067 CET	49841	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.653501987 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.662657976 CET	443	49837	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.663098097 CET	443	49837	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.663139105 CET	49837	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.663290977 CET	49837	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.663300991 CET	443	49837	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.663317919 CET	49837	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.663321018 CET	443	49837	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.666307926 CET	49842	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.666351080 CET	443	49842	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:25.666420937 CET	49842	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.666555882 CET	49842	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:25.666601896 CET	443	49842	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.356337070 CET	443	49838	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.356971025 CET	49838	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.356997967 CET	443	49838	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.357601881 CET	49838	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.357614994 CET	443	49838	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.387768030 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.388417959 CET	49839	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.388438940 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.389065027 CET	49839	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.389069080 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.398441076 CET	443	49840	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.399055958 CET	49840	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.399096012 CET	443	49840	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.399535894 CET	49840	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.399548054 CET	443	49840	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.409910917 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.410490036 CET	49841	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.410510063 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.411039114 CET	49841	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.411043882 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.423758984 CET	443	49842	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.424242020 CET	49842	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.424272060 CET	443	49842	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.424689054 CET	49842	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.424701929 CET	443	49842	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.496079922 CET	443	49838	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.496134043 CET	443	49838	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.496237040 CET	49838	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.499227047 CET	49838	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.499249935 CET	443	49838	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.499270916 CET	49838	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.499278069 CET	443	49838	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.504565001 CET	49843	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.504590034 CET	443	49843	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.504652977 CET	49843	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.505362988 CET	49843	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.505372047 CET	443	49843	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.528390884 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.528614044 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.528647900 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.528655052 CET	49839	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.528765917 CET	49839	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.529017925 CET	49839	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.529027939 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.529041052 CET	49839	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.529045105 CET	443	49839	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.533647060 CET	443	49840	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.533708096 CET	443	49840	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.533761024 CET	49840	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.536027908 CET	49844	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.536043882 CET	443	49844	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.536099911 CET	49844	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.537230968 CET	49840	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.537252903 CET	443	49840	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.537266970 CET	49840	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.537273884 CET	443	49840	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.541392088 CET	49844	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.541403055 CET	443	49844	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.546268940 CET	49845	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.546310902 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.546377897 CET	49845	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.547022104 CET	49845	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.547039032 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.547332048 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.547600985 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.547633886 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.547647953 CET	49841	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.547697067 CET	49841	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.548295975 CET	49841	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.548314095 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.548327923 CET	49841	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.548331976 CET	443	49841	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.557748079 CET	49846	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.557758093 CET	443	49846	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.557826042 CET	49846	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.558429956 CET	49846	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.558440924 CET	443	49846	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.560762882 CET	443	49842	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.560946941 CET	443	49842	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.561002970 CET	49842	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.561173916 CET	49842	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.561202049 CET	443	49842	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.561230898 CET	49842	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.561244011 CET	443	49842	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.564383030 CET	49847	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.564423084 CET	443	49847	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:26.564507008 CET	49847	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.564646959 CET	49847	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:26.564661980 CET	443	49847	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.280221939 CET	443	49844	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.281306028 CET	49844	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.281337023 CET	443	49844	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.284674883 CET	49844	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.284679890 CET	443	49844	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.293984890 CET	443	49843	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.294959068 CET	49843	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.294972897 CET	443	49843	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.297180891 CET	49843	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.297188044 CET	443	49843	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.308166027 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.308718920 CET	49845	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.308738947 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.309178114 CET	49845	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.309184074 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.313117027 CET	443	49847	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.313549042 CET	49847	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.313560009 CET	443	49847	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.314069033 CET	49847	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.314074039 CET	443	49847	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.316483974 CET	443	49846	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.317596912 CET	49846	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.317631960 CET	443	49846	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.321187019 CET	49846	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.321192026 CET	443	49846	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.414952040 CET	443	49844	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.415149927 CET	443	49844	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.415297031 CET	49844	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.415498018 CET	49844	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.415508986 CET	443	49844	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.415530920 CET	49844	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.415535927 CET	443	49844	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.421264887 CET	49848	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.421284914 CET	443	49848	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.421380043 CET	49848	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.421669006 CET	49848	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.421698093 CET	443	49848	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.436758041 CET	443	49843	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.436880112 CET	443	49843	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.440586090 CET	49843	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.440613031 CET	49843	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.440613031 CET	49843	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.440623045 CET	443	49843	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.440632105 CET	443	49843	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.445261955 CET	49849	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.445298910 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.445424080 CET	49849	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.445643902 CET	49849	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.445662975 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.445725918 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.446017027 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.446048021 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.446139097 CET	49845	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.446300030 CET	49845	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.446300030 CET	49845	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.446316004 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.446320057 CET	443	49845	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.447272062 CET	443	49847	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.447334051 CET	443	49847	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.447552919 CET	49847	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.447654963 CET	49847	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.447654963 CET	49847	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.447659969 CET	443	49847	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.447668076 CET	443	49847	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.449182987 CET	49850	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.449218988 CET	443	49850	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.449301958 CET	49850	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.449527979 CET	49850	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.449554920 CET	443	49850	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.450398922 CET	49851	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.450424910 CET	443	49851	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.453267097 CET	49851	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.453479052 CET	49851	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.453491926 CET	443	49851	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.455466032 CET	443	49846	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.455558062 CET	443	49846	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.455634117 CET	49846	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.455815077 CET	49846	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.455815077 CET	49846	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.455822945 CET	443	49846	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.455826044 CET	443	49846	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.458302021 CET	49852	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.458322048 CET	443	49852	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:27.461249113 CET	49852	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.461349010 CET	49852	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:27.461359978 CET	443	49852	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.176511049 CET	443	49848	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.177151918 CET	49848	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.177177906 CET	443	49848	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.177737951 CET	49848	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.177748919 CET	443	49848	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.203423023 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.204096079 CET	49849	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.204124928 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.204685926 CET	49849	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.204699993 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.210908890 CET	443	49852	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.211405993 CET	49852	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.211436033 CET	443	49852	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.211955070 CET	49852	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.211966991 CET	443	49852	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.212143898 CET	443	49850	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.212487936 CET	49850	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.212517023 CET	443	49850	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.212920904 CET	49850	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.212928057 CET	443	49850	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.214319944 CET	443	49851	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.214673042 CET	49851	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.214688063 CET	443	49851	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.215080976 CET	49851	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.215086937 CET	443	49851	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.313890934 CET	443	49848	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.313965082 CET	443	49848	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.314097881 CET	49848	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.314356089 CET	49848	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.314372063 CET	443	49848	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.314385891 CET	49848	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.314390898 CET	443	49848	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.317723036 CET	49853	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.317763090 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.317893982 CET	49853	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.318100929 CET	49853	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.318115950 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.341059923 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.341114044 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.341151953 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.341191053 CET	49849	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.341244936 CET	49849	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.341420889 CET	49849	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.341442108 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.341454029 CET	49849	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.341459990 CET	443	49849	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.344563007 CET	49854	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.344588995 CET	443	49854	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.344655037 CET	49854	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.344846010 CET	49854	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.344862938 CET	443	49854	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.346633911 CET	443	49852	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.346915960 CET	443	49852	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.347013950 CET	49852	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.347090006 CET	49852	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.347110033 CET	443	49852	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.347131014 CET	49852	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.347150087 CET	443	49852	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.349390984 CET	49855	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.349423885 CET	443	49855	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.349546909 CET	49855	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.349720955 CET	49855	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.349730015 CET	443	49855	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.352400064 CET	443	49851	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.352442026 CET	443	49850	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.352715015 CET	443	49850	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.352766991 CET	49850	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.352895021 CET	443	49851	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.352897882 CET	49850	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.352910042 CET	443	49850	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.352930069 CET	49850	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.352933884 CET	443	49850	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.352967978 CET	49851	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.353435040 CET	49851	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.353450060 CET	443	49851	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.355787039 CET	49856	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.355803967 CET	443	49856	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.355940104 CET	49856	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.356076002 CET	49856	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.356091976 CET	443	49856	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.356278896 CET	49857	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.356309891 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:28.356364965 CET	49857	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.356550932 CET	49857	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:28.356565952 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.101928949 CET	443	49854	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.103121042 CET	49854	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.103121042 CET	49854	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.103137970 CET	443	49854	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.103147030 CET	443	49854	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.104094982 CET	443	49855	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.104485989 CET	49855	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.104523897 CET	443	49855	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.107036114 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.107075930 CET	49855	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.107083082 CET	443	49855	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.107510090 CET	49857	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.107517004 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.107961893 CET	49857	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.107968092 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.112487078 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.113255978 CET	49853	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.113255978 CET	49853	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.113265991 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.113280058 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.115775108 CET	443	49856	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.119767904 CET	49856	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.119782925 CET	443	49856	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.123214960 CET	49856	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.123219967 CET	443	49856	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.237910032 CET	443	49854	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.238014936 CET	443	49854	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.238790035 CET	49854	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.238895893 CET	49854	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.238914013 CET	443	49854	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.238934040 CET	49854	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.238939047 CET	443	49854	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.240057945 CET	443	49855	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.240178108 CET	443	49855	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.241827011 CET	49858	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.241863966 CET	443	49858	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.241875887 CET	49855	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.241875887 CET	49855	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.241936922 CET	49855	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.241945982 CET	443	49855	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.242079020 CET	49858	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.242129087 CET	49858	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.242136955 CET	443	49858	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.243176937 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.243201971 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.243241072 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.243302107 CET	49857	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.243405104 CET	49857	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.243462086 CET	49857	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.243462086 CET	49857	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.243469000 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.243475914 CET	443	49857	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.245310068 CET	49860	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.245313883 CET	49859	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.245337963 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.245345116 CET	443	49860	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.247262955 CET	49859	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.247265100 CET	49860	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.247519970 CET	49860	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.247520924 CET	49859	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.247534037 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.247534990 CET	443	49860	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.255614996 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.256063938 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.256103039 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.256172895 CET	49853	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.256232977 CET	49853	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.256295919 CET	49853	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.256295919 CET	49853	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.256304979 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.256313086 CET	443	49853	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.258264065 CET	49861	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.258294106 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.259393930 CET	49861	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.259495974 CET	49861	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.259506941 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.260169983 CET	443	49856	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.263621092 CET	443	49856	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.265325069 CET	49856	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.265348911 CET	49856	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.265348911 CET	49856	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.265357971 CET	443	49856	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.265366077 CET	443	49856	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.268204927 CET	49862	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.268241882 CET	443	49862	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:29.272408962 CET	49862	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.272408962 CET	49862	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:29.272448063 CET	443	49862	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.004273891 CET	443	49858	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.004643917 CET	443	49860	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.005280018 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.010638952 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.020921946 CET	49858	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.020934105 CET	443	49858	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.021950006 CET	49858	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.021956921 CET	443	49858	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.022319078 CET	49860	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.022330046 CET	443	49860	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.022938013 CET	49860	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.022953033 CET	443	49860	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.023493052 CET	49859	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.023504972 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.023942947 CET	49859	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.023948908 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.024194002 CET	49861	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.024209023 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.024771929 CET	49861	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.024776936 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.030977011 CET	443	49862	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.031747103 CET	49862	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.031755924 CET	443	49862	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.032358885 CET	49862	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.032376051 CET	443	49862	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.153970957 CET	443	49860	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.154053926 CET	443	49860	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.154097080 CET	49860	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.154401064 CET	49860	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.154417038 CET	443	49860	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.154426098 CET	49860	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.154432058 CET	443	49860	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.154891968 CET	443	49858	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.154963970 CET	443	49858	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.155000925 CET	49858	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.155291080 CET	49858	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.155317068 CET	443	49858	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.155328035 CET	49858	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.155333042 CET	443	49858	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.157243013 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.157265902 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.157299042 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.157315016 CET	49859	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.157336950 CET	49859	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.158565044 CET	49863	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.158631086 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.158704996 CET	49863	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.158735991 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.158874989 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.158905983 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.158926964 CET	49861	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.159029007 CET	49861	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.159307957 CET	49859	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.159331083 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.159343004 CET	49859	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.159348011 CET	443	49859	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.159353018 CET	49864	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.159393072 CET	443	49864	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.159427881 CET	49864	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.159605026 CET	49864	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.159621000 CET	443	49864	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.160115004 CET	49861	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.160115004 CET	49861	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.160115004 CET	49863	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.160145998 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.160171032 CET	443	49861	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.160206079 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.163228035 CET	49865	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.163260937 CET	443	49865	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.163328886 CET	49865	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.163539886 CET	49865	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.163552046 CET	443	49865	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.163641930 CET	49866	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.163654089 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.163712978 CET	49866	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.163853884 CET	49866	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.163861990 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.169078112 CET	443	49862	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.169795036 CET	443	49862	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.169837952 CET	49862	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.169876099 CET	49862	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.169887066 CET	443	49862	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.169904947 CET	49862	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.169909000 CET	443	49862	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.172573090 CET	49867	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.172584057 CET	443	49867	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.172635078 CET	49867	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.172831059 CET	49867	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.172838926 CET	443	49867	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.900412083 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.901480913 CET	49866	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.901480913 CET	49866	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.901504993 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.901521921 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.908540964 CET	443	49864	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.909528971 CET	49864	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.909543991 CET	443	49864	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.910001040 CET	49864	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.910007000 CET	443	49864	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.912247896 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.912704945 CET	49863	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.912743092 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.913017035 CET	49863	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.913022995 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.913413048 CET	443	49865	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.914120913 CET	49865	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.914120913 CET	49865	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.914155006 CET	443	49865	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.914171934 CET	443	49865	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.917133093 CET	443	49867	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.917864084 CET	49867	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.917871952 CET	443	49867	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:30.918610096 CET	49867	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:30.918615103 CET	443	49867	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.034609079 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.034692049 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.034742117 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.037256002 CET	49866	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.038163900 CET	49866	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.038165092 CET	49866	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.038202047 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.038213968 CET	443	49866	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.041383982 CET	49868	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.041414022 CET	443	49868	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.041611910 CET	49868	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.042151928 CET	49868	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.042162895 CET	443	49868	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.044557095 CET	443	49864	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.044779062 CET	443	49864	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.044902086 CET	49864	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.044940948 CET	49864	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.044940948 CET	49864	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.044950008 CET	443	49864	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.044960022 CET	443	49864	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.049129009 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.049155951 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.049164057 CET	49869	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.049201012 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.049212933 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.049284935 CET	49863	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.049384117 CET	49869	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.049468994 CET	49869	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.049468994 CET	49863	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.049468994 CET	49863	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.049483061 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.049494028 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.049506903 CET	443	49863	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.051697969 CET	443	49865	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.051728010 CET	49870	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.051753044 CET	443	49870	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.051870108 CET	49870	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.052119017 CET	49870	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.052130938 CET	443	49870	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.052169085 CET	443	49865	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.052258015 CET	49865	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.052357912 CET	49865	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.052357912 CET	49865	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.052371979 CET	443	49865	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.052381039 CET	443	49865	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.053366899 CET	443	49867	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.053561926 CET	443	49867	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.053739071 CET	49867	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.053869009 CET	49867	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.053873062 CET	443	49867	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.053894997 CET	49867	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.053899050 CET	443	49867	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.055671930 CET	49872	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.055672884 CET	49871	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.055685997 CET	443	49872	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.055705070 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.055757999 CET	49872	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.055759907 CET	49871	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.055998087 CET	49872	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.056011915 CET	443	49872	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.056039095 CET	49871	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.056055069 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.782582998 CET	443	49868	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.783188105 CET	49868	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.783205032 CET	443	49868	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.783746004 CET	49868	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.783752918 CET	443	49868	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.799644947 CET	443	49872	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.800156116 CET	49872	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.800178051 CET	443	49872	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.800699949 CET	49872	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.800704956 CET	443	49872	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.809004068 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.809437990 CET	49869	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.809456110 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.809876919 CET	49869	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.809883118 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.827188969 CET	443	49870	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.827605963 CET	49870	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.827620029 CET	443	49870	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.828057051 CET	49870	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.828063965 CET	443	49870	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.843574047 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.843962908 CET	49871	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.843977928 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.844410896 CET	49871	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.844417095 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.918550014 CET	443	49868	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.919061899 CET	443	49868	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.919150114 CET	49868	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.919176102 CET	49868	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.919188976 CET	443	49868	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.919214964 CET	49868	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.919219971 CET	443	49868	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.921709061 CET	49873	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.921751022 CET	443	49873	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.921852112 CET	49873	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.922002077 CET	49873	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.922013044 CET	443	49873	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.935035944 CET	443	49872	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.935100079 CET	443	49872	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.935158014 CET	49872	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.935309887 CET	49872	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.935326099 CET	443	49872	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.935333967 CET	49872	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.935338020 CET	443	49872	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.937681913 CET	49874	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.937702894 CET	443	49874	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.937808037 CET	49874	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.937927008 CET	49874	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.937937021 CET	443	49874	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.948744059 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.949042082 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.949089050 CET	49869	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.949093103 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.949147940 CET	49869	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.949202061 CET	49869	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.949229002 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.949248075 CET	49869	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.949254990 CET	443	49869	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.951178074 CET	49875	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.951195955 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.951323986 CET	49875	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.951430082 CET	49875	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.951442003 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.975033998 CET	443	49870	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.975116968 CET	443	49870	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.975186110 CET	49870	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.975186110 CET	49870	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.975310087 CET	49870	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.975327969 CET	443	49870	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.975337982 CET	49870	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.975342989 CET	443	49870	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.977777958 CET	49876	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.977824926 CET	443	49876	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.977896929 CET	49876	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.978053093 CET	49876	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.978070021 CET	443	49876	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.987083912 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.987170935 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.987210035 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.987222910 CET	49871	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.987262011 CET	49871	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.987348080 CET	49871	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.987369061 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.987381935 CET	49871	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.987389088 CET	443	49871	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.989690065 CET	49877	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.989712000 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:31.989836931 CET	49877	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.989969969 CET	49877	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:31.989979982 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.574096918 CET	443	49873	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.574666023 CET	49873	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.574673891 CET	443	49873	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.575220108 CET	49873	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.575225115 CET	443	49873	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.579205990 CET	443	49874	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.579613924 CET	49874	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.579622030 CET	443	49874	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.580076933 CET	49874	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.580081940 CET	443	49874	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.581099033 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.581382990 CET	49877	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.581402063 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.581531048 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.581837893 CET	49877	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.581844091 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.582050085 CET	49875	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.582057953 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.582334995 CET	443	49876	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.582402945 CET	49875	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.582407951 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.582691908 CET	49876	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.582715988 CET	443	49876	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.583095074 CET	49876	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.583100080 CET	443	49876	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.707039118 CET	443	49873	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.707108021 CET	443	49873	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.707206964 CET	49873	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.707518101 CET	49873	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.707525015 CET	443	49873	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.707537889 CET	49873	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.707545996 CET	443	49873	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.710658073 CET	49878	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.710670948 CET	443	49878	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.710763931 CET	49878	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.710954905 CET	49878	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.710962057 CET	443	49878	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718039036 CET	443	49874	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718097925 CET	443	49874	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718156099 CET	49874	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.718254089 CET	49874	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.718261957 CET	443	49874	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718270063 CET	49874	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.718272924 CET	443	49874	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718703032 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718764067 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718801975 CET	49875	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.718808889 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718820095 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718852043 CET	49875	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.718888998 CET	49875	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.718895912 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.718905926 CET	49875	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.718909025 CET	443	49875	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.720493078 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.720807076 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.720843077 CET	443	49876	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.720848083 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.720870972 CET	49877	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.720923901 CET	443	49876	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.720948935 CET	49877	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.720987082 CET	49876	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.722173929 CET	49879	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.722199917 CET	443	49879	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.722253084 CET	49879	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.722466946 CET	49879	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.722477913 CET	443	49879	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.723738909 CET	49880	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.723763943 CET	443	49880	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.723807096 CET	49880	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.723916054 CET	49877	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.723927975 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.723937988 CET	49877	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.723942041 CET	443	49877	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.724816084 CET	49876	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.724838018 CET	443	49876	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.724850893 CET	49876	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.724857092 CET	443	49876	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.725924015 CET	49880	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.725936890 CET	443	49880	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.727427006 CET	49881	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.727466106 CET	443	49881	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.727555037 CET	49881	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.727710009 CET	49881	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.727725029 CET	443	49881	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.728934050 CET	49882	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.728946924 CET	443	49882	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:33.729002953 CET	49882	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.729146957 CET	49882	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:33.729154110 CET	443	49882	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.464250088 CET	443	49878	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.464838982 CET	49878	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.464853048 CET	443	49878	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.465414047 CET	49878	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.465418100 CET	443	49878	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.467963934 CET	443	49880	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.468312025 CET	49880	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.468322992 CET	443	49880	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.468751907 CET	49880	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.468755960 CET	443	49880	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.468904972 CET	443	49879	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.469247103 CET	49879	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.469260931 CET	443	49879	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.469800949 CET	49879	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.469805956 CET	443	49879	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.490979910 CET	443	49881	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.491580963 CET	49881	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.491602898 CET	443	49881	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.492064953 CET	49881	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.492069960 CET	443	49881	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.493787050 CET	443	49882	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.494116068 CET	49882	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.494143009 CET	443	49882	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.494532108 CET	49882	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.494539022 CET	443	49882	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.600011110 CET	443	49878	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.600075960 CET	443	49878	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.600141048 CET	49878	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.600743055 CET	49878	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.600764036 CET	443	49878	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.600775003 CET	49878	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.600780010 CET	443	49878	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.602201939 CET	443	49880	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.602257013 CET	443	49880	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.602329016 CET	49880	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.603259087 CET	49880	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.603271961 CET	443	49880	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.603302002 CET	49880	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.603308916 CET	443	49880	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.605149031 CET	443	49879	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.605592012 CET	443	49879	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.605670929 CET	49879	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.605972052 CET	49879	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.605983019 CET	443	49879	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.606034994 CET	49879	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.606040001 CET	443	49879	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.608819008 CET	49883	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.608861923 CET	443	49883	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.608942986 CET	49883	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.609123945 CET	49884	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.609169960 CET	443	49884	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.609276056 CET	49884	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.610431910 CET	49883	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.610447884 CET	443	49883	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.611129045 CET	49885	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.611164093 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.611257076 CET	49885	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.611745119 CET	49885	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.611747980 CET	49884	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.611762047 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.611764908 CET	443	49884	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.630889893 CET	443	49881	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.630960941 CET	443	49881	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.631038904 CET	49881	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.631239891 CET	49881	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.631241083 CET	49881	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.631262064 CET	443	49881	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.631273031 CET	443	49881	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.633302927 CET	443	49882	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.633392096 CET	443	49882	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.633578062 CET	49882	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.633784056 CET	49882	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.633784056 CET	49882	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.633805037 CET	443	49882	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.633816004 CET	443	49882	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.634871006 CET	49886	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.634922028 CET	443	49886	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.634999990 CET	49886	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.635421991 CET	49886	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.635437965 CET	443	49886	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.636917114 CET	49887	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.636969090 CET	443	49887	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:34.637073040 CET	49887	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.637495041 CET	49887	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:34.637506962 CET	443	49887	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.359827995 CET	443	49883	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.360779047 CET	49883	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.360779047 CET	49883	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.360802889 CET	443	49883	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.360821009 CET	443	49883	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.368310928 CET	443	49884	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.369230986 CET	49884	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.369259119 CET	443	49884	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.369734049 CET	49884	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.369740963 CET	443	49884	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.376832962 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.377470016 CET	49885	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.377515078 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.377893925 CET	49885	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.377902031 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.403166056 CET	443	49886	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.403834105 CET	49886	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.403867006 CET	443	49886	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.404266119 CET	49886	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.404270887 CET	443	49886	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.426084995 CET	443	49887	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.426877975 CET	49887	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.426898956 CET	443	49887	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.427092075 CET	49887	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.427118063 CET	443	49887	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.497646093 CET	443	49883	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.497720003 CET	443	49883	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.498027086 CET	49883	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.498027086 CET	49883	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.498899937 CET	49883	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.498919964 CET	443	49883	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.500699997 CET	49888	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.500746012 CET	443	49888	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.501327038 CET	49888	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.501679897 CET	49888	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.501691103 CET	443	49888	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.507509947 CET	443	49884	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.507601023 CET	443	49884	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.508990049 CET	49884	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.508990049 CET	49884	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.509032011 CET	49884	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.509052038 CET	443	49884	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.510957956 CET	49889	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.510989904 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.511187077 CET	49889	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.511187077 CET	49889	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.511210918 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.516213894 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.516271114 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.516309023 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.516427994 CET	49885	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.516427994 CET	49885	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.516475916 CET	49885	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.516475916 CET	49885	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.516489983 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.516494989 CET	443	49885	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.518289089 CET	49890	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.518322945 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.518500090 CET	49890	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.518500090 CET	49890	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.518524885 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.540733099 CET	443	49886	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.540793896 CET	443	49886	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.541253090 CET	49886	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.541253090 CET	49886	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.542905092 CET	49886	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.542923927 CET	443	49886	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.543339968 CET	49891	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.543356895 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.544003010 CET	49891	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.544586897 CET	49891	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.544596910 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.569171906 CET	443	49887	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.569251060 CET	443	49887	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.570051908 CET	49887	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.570051908 CET	49887	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.570512056 CET	49887	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.570533991 CET	443	49887	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.572788954 CET	49892	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.572830915 CET	443	49892	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:35.573324919 CET	49892	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.573429108 CET	49892	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:35.573441982 CET	443	49892	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.245055914 CET	443	49888	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.245821953 CET	49888	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.245850086 CET	443	49888	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.246416092 CET	49888	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.246423960 CET	443	49888	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.281790972 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.282454014 CET	49890	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.282479048 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.283097029 CET	49890	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.283103943 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.292365074 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.293059111 CET	49891	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.293112040 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.293690920 CET	49891	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.293704987 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.296490908 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.296953917 CET	49889	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.296983957 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.297519922 CET	49889	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.297533035 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.333324909 CET	443	49892	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.333986044 CET	49892	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.334009886 CET	443	49892	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.334683895 CET	49892	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.334688902 CET	443	49892	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.380033016 CET	443	49888	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.380120993 CET	443	49888	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.380182028 CET	49888	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.380390882 CET	49888	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.380412102 CET	443	49888	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.380444050 CET	49888	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.380449057 CET	443	49888	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.383909941 CET	49893	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.383960962 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.384033918 CET	49893	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.384208918 CET	49893	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.384229898 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.423425913 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.423846006 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.423897028 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.423896074 CET	49890	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.423948050 CET	49890	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.423996925 CET	49890	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.424025059 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.424051046 CET	49890	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.424057961 CET	443	49890	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.426846027 CET	49894	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.426892042 CET	443	49894	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.426980019 CET	49894	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.427165985 CET	49894	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.427181959 CET	443	49894	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.428813934 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.428877115 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.428942919 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.428961992 CET	49891	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.428992987 CET	49891	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.429084063 CET	49891	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.429106951 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.429120064 CET	49891	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.429126978 CET	443	49891	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.432440042 CET	49895	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.432480097 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.432534933 CET	49895	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.432744980 CET	49895	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.432756901 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.437918901 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.437942982 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.437993050 CET	49889	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.437998056 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.438095093 CET	49889	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.438237906 CET	49889	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.438271046 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.438287020 CET	49889	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.438296080 CET	443	49889	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.441659927 CET	49896	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.441687107 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.441761971 CET	49896	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.441900969 CET	49896	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.441910982 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.471631050 CET	443	49892	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.471698999 CET	443	49892	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.471761942 CET	49892	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.471992970 CET	49892	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.472013950 CET	443	49892	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.472028017 CET	49892	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.472033978 CET	443	49892	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.475275993 CET	49897	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.475330114 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:36.475383997 CET	49897	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.475625992 CET	49897	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:36.475640059 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.152116060 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.153126955 CET	49893	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.153187037 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.153439045 CET	49893	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.153450012 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.188772917 CET	443	49894	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.190763950 CET	49894	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.190790892 CET	443	49894	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.191174984 CET	49894	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.191184044 CET	443	49894	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.191751957 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.192466974 CET	49895	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.192466974 CET	49895	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.192512989 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.192521095 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.198319912 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.199794054 CET	49896	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.199819088 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.200062990 CET	49896	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.200067997 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.235294104 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.236186028 CET	49897	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.236202955 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.236777067 CET	49897	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.236783028 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.291140079 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.291171074 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.291218042 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.291336060 CET	49893	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.291337013 CET	49893	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.291496038 CET	49893	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.291496038 CET	49893	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.291520119 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.291534901 CET	443	49893	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.294727087 CET	49898	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.294765949 CET	443	49898	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.295133114 CET	49898	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.295494080 CET	49898	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.295509100 CET	443	49898	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.328789949 CET	443	49894	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.328870058 CET	443	49894	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.328974962 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.328994036 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.329027891 CET	49894	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.329078913 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.329113007 CET	49895	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.329206944 CET	49895	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.329233885 CET	49894	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.329233885 CET	49894	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.329252958 CET	443	49894	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.329266071 CET	443	49894	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.329274893 CET	49895	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.329274893 CET	49895	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.329294920 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.329301119 CET	443	49895	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.332225084 CET	49900	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.332274914 CET	443	49900	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.332407951 CET	49899	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.332448959 CET	443	49899	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.332520008 CET	49900	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.332529068 CET	49899	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.332906961 CET	49900	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.332928896 CET	443	49900	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.333090067 CET	49899	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.333106995 CET	443	49899	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.336163044 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.336189032 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.336229086 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.336256981 CET	49896	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.336395979 CET	49896	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.336533070 CET	49896	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.336533070 CET	49896	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.336549044 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.336560011 CET	443	49896	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.341291904 CET	49901	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.341330051 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.341659069 CET	49901	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.341721058 CET	49901	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.341742039 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.372800112 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.372826099 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.372868061 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.372967958 CET	49897	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.372967958 CET	49897	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.373179913 CET	49897	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.373179913 CET	49897	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.373198032 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.373209953 CET	443	49897	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.375956059 CET	49902	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.376013041 CET	443	49902	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:37.377418995 CET	49902	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.377571106 CET	49902	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:37.377585888 CET	443	49902	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.061281919 CET	443	49898	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.062040091 CET	49898	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.062068939 CET	443	49898	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.062630892 CET	49898	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.062640905 CET	443	49898	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.084280014 CET	443	49900	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.084865093 CET	49900	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.084901094 CET	443	49900	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.085423946 CET	49900	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.085436106 CET	443	49900	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.105215073 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.105771065 CET	49901	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.105786085 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.106359005 CET	49901	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.106375933 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.108650923 CET	443	49899	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.109033108 CET	49899	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.109042883 CET	443	49899	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.109499931 CET	49899	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.109505892 CET	443	49899	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.154069901 CET	443	49902	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.154649973 CET	49902	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.154683113 CET	443	49902	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.155209064 CET	49902	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.155222893 CET	443	49902	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.222578049 CET	443	49900	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.222672939 CET	443	49900	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.222762108 CET	49900	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.223109961 CET	49900	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.223159075 CET	443	49900	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.223198891 CET	49900	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.223216057 CET	443	49900	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.228954077 CET	49903	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.228996038 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.229057074 CET	49903	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.229389906 CET	49903	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.229402065 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.242703915 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.242738008 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.242796898 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.242811918 CET	49901	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.242856979 CET	49901	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.243120909 CET	49901	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.243139982 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.243153095 CET	49901	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.243160009 CET	443	49901	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.246841908 CET	49904	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.246880054 CET	443	49904	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.246936083 CET	49904	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.247209072 CET	49904	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.247226000 CET	443	49904	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.249828100 CET	443	49899	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.249903917 CET	443	49899	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.249948978 CET	49899	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.250180960 CET	49899	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.250195026 CET	443	49899	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.250205994 CET	49899	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.250211954 CET	443	49899	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.253815889 CET	49905	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.253856897 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.253911018 CET	49905	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.254141092 CET	49905	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.254152060 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.295583963 CET	443	49902	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.295660019 CET	443	49902	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.295732021 CET	49902	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.296087027 CET	49902	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.296087027 CET	49902	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.296138048 CET	443	49902	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.296179056 CET	443	49902	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.299612999 CET	49906	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.299657106 CET	443	49906	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.299714088 CET	49906	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.299978018 CET	49906	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.299994946 CET	443	49906	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.526424885 CET	443	49898	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.526515961 CET	443	49898	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.526567936 CET	49898	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.528333902 CET	49898	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.528362036 CET	443	49898	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.528377056 CET	49898	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.528383017 CET	443	49898	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.534414053 CET	49907	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.534444094 CET	443	49907	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.534502029 CET	49907	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.534884930 CET	49907	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.534895897 CET	443	49907	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.982933044 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.986001968 CET	49903	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.986001968 CET	49903	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.986018896 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.986035109 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.995074034 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.996268988 CET	49905	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.996268988 CET	49905	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:38.996289015 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:38.996304989 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.049103022 CET	443	49906	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.055442095 CET	49906	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.055453062 CET	443	49906	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.056150913 CET	49906	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.056154966 CET	443	49906	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.119905949 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.119992018 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.120042086 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.125252962 CET	49903	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.129534006 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.129568100 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.129618883 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.135273933 CET	49905	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.180332899 CET	49903	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.180366993 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.180418968 CET	49903	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.180427074 CET	443	49903	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.181746960 CET	49905	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.181747913 CET	49905	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.181807041 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.181824923 CET	443	49905	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.187299967 CET	49908	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.187302113 CET	49909	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.187339067 CET	443	49908	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.187382936 CET	443	49909	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.187478065 CET	49908	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.187478065 CET	49909	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.187721014 CET	49908	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.187746048 CET	443	49908	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.187963963 CET	49909	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.187985897 CET	443	49909	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.189186096 CET	443	49906	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.189265013 CET	443	49906	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.189367056 CET	49906	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.189562082 CET	49906	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.189574957 CET	443	49906	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.189601898 CET	49906	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.189608097 CET	443	49906	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.196912050 CET	49910	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.196938038 CET	443	49910	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.197123051 CET	49910	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.197330952 CET	49910	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.197360039 CET	443	49910	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.284091949 CET	443	49907	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.342466116 CET	49907	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.342514992 CET	443	49907	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.346642971 CET	49907	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.346669912 CET	443	49907	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.429523945 CET	443	49904	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.454405069 CET	49904	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.454405069 CET	49904	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.454431057 CET	443	49904	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.454441071 CET	443	49904	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.478605986 CET	443	49907	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.478698015 CET	443	49907	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.481590033 CET	49907	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.481841087 CET	49907	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.481842041 CET	49907	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.481864929 CET	443	49907	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.481882095 CET	443	49907	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.492484093 CET	49911	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.492583036 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.492722034 CET	49911	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.493000984 CET	49911	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.493032932 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.593022108 CET	443	49904	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.593094110 CET	443	49904	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.593389988 CET	49904	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.593621969 CET	49904	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.593621969 CET	49904	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.593638897 CET	443	49904	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.593647003 CET	443	49904	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.596421003 CET	49912	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.596482038 CET	443	49912	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.596832991 CET	49912	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.596832991 CET	49912	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.596880913 CET	443	49912	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.945442915 CET	443	49910	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.946149111 CET	49910	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.946165085 CET	443	49910	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.946696997 CET	49910	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.946702957 CET	443	49910	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.976372957 CET	443	49909	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.977010965 CET	49909	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.977076054 CET	443	49909	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.977552891 CET	49909	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.977570057 CET	443	49909	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.989854097 CET	443	49908	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.990360975 CET	49908	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.990372896 CET	443	49908	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:39.990984917 CET	49908	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:39.990992069 CET	443	49908	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.079870939 CET	443	49910	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.079931974 CET	443	49910	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.079989910 CET	49910	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.080223083 CET	49910	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.080245018 CET	443	49910	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.080276966 CET	49910	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.080286026 CET	443	49910	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.083713055 CET	49913	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.083758116 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.083826065 CET	49913	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.084018946 CET	49913	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.084032059 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.115753889 CET	443	49909	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.115829945 CET	443	49909	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.115914106 CET	49909	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.116116047 CET	49909	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.116116047 CET	49909	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.116138935 CET	443	49909	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.116151094 CET	443	49909	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.119525909 CET	49914	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.119574070 CET	443	49914	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.119636059 CET	49914	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.119828939 CET	49914	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.119844913 CET	443	49914	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.131891012 CET	443	49908	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.132018089 CET	443	49908	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.132071972 CET	49908	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.132205963 CET	49908	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.132205963 CET	49908	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.132225990 CET	443	49908	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.132236958 CET	443	49908	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.135633945 CET	49915	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.135679960 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.135742903 CET	49915	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.135927916 CET	49915	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.135940075 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.248023033 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.248626947 CET	49911	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.248714924 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.249228954 CET	49911	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.249243975 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.360166073 CET	443	49912	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.360830069 CET	49912	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.360852003 CET	443	49912	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.361454964 CET	49912	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.361474991 CET	443	49912	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.387032986 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.387064934 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.387120962 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.387126923 CET	49911	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.387166023 CET	49911	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.387389898 CET	49911	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.387413025 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.387444019 CET	49911	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.387450933 CET	443	49911	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.391995907 CET	49916	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.392038107 CET	443	49916	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.392107010 CET	49916	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.392250061 CET	49916	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.392266989 CET	443	49916	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.498822927 CET	443	49912	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.498908997 CET	443	49912	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.498964071 CET	49912	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.499129057 CET	49912	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.499150991 CET	443	49912	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.499181986 CET	49912	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.499191999 CET	443	49912	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.502928972 CET	49917	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.502985001 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.503050089 CET	49917	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.503213882 CET	49917	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.503226995 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.845426083 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.846451998 CET	49913	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.846481085 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.847070932 CET	49913	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.847086906 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.871900082 CET	443	49914	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.872968912 CET	49914	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.872968912 CET	49914	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.873002052 CET	443	49914	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.873014927 CET	443	49914	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.895445108 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.896548986 CET	49915	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.896548986 CET	49915	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.896579027 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.896596909 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.981659889 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.981693029 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.981739044 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.981884003 CET	49913	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.981884003 CET	49913	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.982357025 CET	49913	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.982378006 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.982410908 CET	49913	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.982417107 CET	443	49913	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.986417055 CET	49918	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.986462116 CET	443	49918	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:40.986706972 CET	49918	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.989245892 CET	49918	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:40.989270926 CET	443	49918	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.010904074 CET	443	49914	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.011334896 CET	443	49914	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.013355017 CET	49914	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.013355017 CET	49914	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.013355017 CET	49914	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.016187906 CET	49919	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.016232967 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.016597986 CET	49919	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.016766071 CET	49919	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.016777039 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.033447027 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.033548117 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.033601999 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.033700943 CET	49915	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.033700943 CET	49915	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.033979893 CET	49915	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.033987999 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.034017086 CET	49915	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.034019947 CET	443	49915	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.036916971 CET	49920	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.036956072 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.037208080 CET	49920	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.041225910 CET	49920	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.041241884 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.155364990 CET	443	49916	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.156869888 CET	49916	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.156897068 CET	443	49916	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.157424927 CET	49916	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.157433033 CET	443	49916	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.246014118 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.249735117 CET	49917	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.249766111 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.250261068 CET	49917	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.250266075 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.295658112 CET	443	49916	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.295748949 CET	443	49916	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.295938969 CET	49916	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.296104908 CET	49916	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.296104908 CET	49916	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.296122074 CET	443	49916	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.296125889 CET	443	49916	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.298964977 CET	49921	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.298996925 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.299782038 CET	49921	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.300096035 CET	49921	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.300103903 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.355015039 CET	49914	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.355051994 CET	443	49914	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.384999037 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.385030031 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.385088921 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.385210037 CET	49917	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.385415077 CET	49917	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.385415077 CET	49917	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.385437012 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.385447025 CET	443	49917	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.393269062 CET	49922	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.393312931 CET	443	49922	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.396477938 CET	49922	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.396477938 CET	49922	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.396536112 CET	443	49922	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.765156031 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.772941113 CET	49919	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.772969961 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.773523092 CET	49919	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.773528099 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.784167051 CET	443	49918	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.784888029 CET	49918	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.784905910 CET	443	49918	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.785362005 CET	49918	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.785366058 CET	443	49918	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.795876026 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.798094988 CET	49920	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.798121929 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.798903942 CET	49920	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.798914909 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.905869007 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.905884027 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.905972004 CET	49919	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.905988932 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.906138897 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.906212091 CET	49919	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.927588940 CET	443	49918	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.927663088 CET	443	49918	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.927720070 CET	49918	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.935394049 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.935410023 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.935475111 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.935518980 CET	49920	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.935569048 CET	49920	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.988466024 CET	49919	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.988492012 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:41.988506079 CET	49919	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:41.988512039 CET	443	49919	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.004551888 CET	49918	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.004568100 CET	443	49918	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.004580021 CET	49918	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.004585028 CET	443	49918	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.031157017 CET	49920	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.031157017 CET	49920	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.031193972 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.031209946 CET	443	49920	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.048674107 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.079663038 CET	49921	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.079694986 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.080338955 CET	49921	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.080348969 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.113538980 CET	49923	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.113591909 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.113671064 CET	49923	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.137901068 CET	49924	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.137943983 CET	443	49924	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.138017893 CET	49924	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.141721010 CET	49925	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.141765118 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.141849995 CET	49925	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.142859936 CET	49923	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.142883062 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.144895077 CET	49924	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.144912004 CET	443	49924	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.145273924 CET	49925	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.145298004 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.146466970 CET	443	49922	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.147274017 CET	49922	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.147289991 CET	443	49922	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.148550987 CET	49922	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.148555994 CET	443	49922	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.212702036 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.212734938 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.212778091 CET	49921	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.212795019 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.212812901 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.212852955 CET	49921	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.213282108 CET	49921	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.213300943 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.213313103 CET	49921	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.213319063 CET	443	49921	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.217948914 CET	49926	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.217987061 CET	443	49926	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.218036890 CET	49926	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.218281031 CET	49926	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.218292952 CET	443	49926	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.282547951 CET	443	49922	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.282613993 CET	443	49922	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.282666922 CET	49922	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.282951117 CET	49922	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.282972097 CET	443	49922	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.282982111 CET	49922	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.282989025 CET	443	49922	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.287257910 CET	49927	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.287303925 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.287364960 CET	49927	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.287770987 CET	49927	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.287790060 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.930278063 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.930845022 CET	49925	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.930871964 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.931377888 CET	49925	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.931391001 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.932791948 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.933134079 CET	443	49924	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.933978081 CET	49923	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.933991909 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.934371948 CET	49923	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.934380054 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.934572935 CET	49924	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.934603930 CET	443	49924	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.935014963 CET	49924	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.935033083 CET	443	49924	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.987864017 CET	443	49926	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.988569021 CET	49926	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.988601923 CET	443	49926	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:42.989054918 CET	49926	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:42.989070892 CET	443	49926	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.038676023 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.039130926 CET	49927	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.039164066 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.041220903 CET	49927	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.041238070 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.068672895 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.068701029 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.068739891 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.068763018 CET	49925	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.068814039 CET	49925	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.069009066 CET	49925	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.069022894 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.069047928 CET	49925	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.069053888 CET	443	49925	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.072283983 CET	443	49924	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.072324038 CET	49928	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.072345972 CET	443	49924	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.072356939 CET	443	49928	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.072422981 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.072431087 CET	49928	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.072432041 CET	49924	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.072494030 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.072550058 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.072572947 CET	49924	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.072590113 CET	443	49924	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.072619915 CET	49923	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.072837114 CET	49928	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.072849989 CET	443	49928	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.073002100 CET	49923	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.073013067 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.073040962 CET	49923	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.073045969 CET	443	49923	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.078748941 CET	49930	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.078751087 CET	49929	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.078761101 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.078787088 CET	443	49929	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.078886986 CET	49929	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.078887939 CET	49930	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.079336882 CET	49930	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.079348087 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.079430103 CET	49929	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.079443932 CET	443	49929	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.123873949 CET	443	49926	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.124072075 CET	443	49926	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.124300003 CET	49926	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.124576092 CET	49926	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.124576092 CET	49926	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.124594927 CET	443	49926	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.124599934 CET	443	49926	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.129250050 CET	49931	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.129278898 CET	443	49931	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.133429050 CET	49931	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.136811018 CET	49931	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.136826992 CET	443	49931	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.175048113 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.175180912 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.175220966 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.175297022 CET	49927	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.175297976 CET	49927	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.175523043 CET	49927	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.175542116 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.175573111 CET	49927	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.175579071 CET	443	49927	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.181229115 CET	49932	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.181252956 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.183367968 CET	49932	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.183434010 CET	49932	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.183440924 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.812927008 CET	443	49928	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.813513041 CET	49928	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.813535929 CET	443	49928	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.814049959 CET	49928	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.814054966 CET	443	49928	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.847414970 CET	443	49929	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.847692966 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.848027945 CET	49929	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.848051071 CET	443	49929	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.848155975 CET	49930	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.848171949 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.848620892 CET	49929	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.848634958 CET	443	49929	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.848725080 CET	49930	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.848730087 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.897042990 CET	443	49931	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.897685051 CET	49931	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.897716045 CET	443	49931	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.898283005 CET	49931	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.898293018 CET	443	49931	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.931025982 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.931662083 CET	49932	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.931678057 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.932169914 CET	49932	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.932178974 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.953722954 CET	443	49928	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.954364061 CET	443	49928	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.954471111 CET	49928	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.954471111 CET	49928	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.954504967 CET	49928	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.954520941 CET	443	49928	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.957865953 CET	49933	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.957915068 CET	443	49933	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.957977057 CET	49933	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.958172083 CET	49933	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.958183050 CET	443	49933	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.986599922 CET	443	49929	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.986975908 CET	443	49929	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.987031937 CET	49929	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.987117052 CET	49929	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.987139940 CET	443	49929	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.987147093 CET	49929	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.987153053 CET	443	49929	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.990638018 CET	49934	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.990678072 CET	443	49934	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:43.990910053 CET	49934	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.991225004 CET	49934	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:43.991235018 CET	443	49934	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.035195112 CET	443	49931	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.035286903 CET	443	49931	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.035346985 CET	49931	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.035568953 CET	49931	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.035578012 CET	443	49931	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.035590887 CET	49931	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.035597086 CET	443	49931	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.039277077 CET	49935	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.039329052 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.039386988 CET	49935	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.039594889 CET	49935	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.039604902 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.066868067 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.067006111 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.067055941 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.067058086 CET	49932	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.067099094 CET	49932	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.067286968 CET	49932	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.067306042 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.067326069 CET	49932	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.067331076 CET	443	49932	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.070983887 CET	49936	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.071007967 CET	443	49936	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.071141958 CET	49936	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.071268082 CET	49936	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.071280003 CET	443	49936	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.132508993 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.132541895 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.132591009 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.132595062 CET	49930	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.132649899 CET	49930	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.132997036 CET	49930	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.133004904 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.133120060 CET	49930	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.133126020 CET	443	49930	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.136661053 CET	49937	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.136682987 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.136745930 CET	49937	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.136989117 CET	49937	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.137001038 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.708518982 CET	443	49933	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.709691048 CET	49933	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.709691048 CET	49933	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.709717035 CET	443	49933	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.709734917 CET	443	49933	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.734364986 CET	443	49934	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.735543013 CET	49934	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.735563993 CET	443	49934	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.735850096 CET	49934	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.735855103 CET	443	49934	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.804527044 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.805135965 CET	49935	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.805167913 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.806015015 CET	49935	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.806027889 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.824739933 CET	443	49936	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.825361013 CET	49936	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.825393915 CET	443	49936	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.827349901 CET	49936	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.827359915 CET	443	49936	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.844620943 CET	443	49933	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.844686031 CET	443	49933	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.845031977 CET	49933	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.845031977 CET	49933	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.845557928 CET	49933	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.845578909 CET	443	49933	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.853249073 CET	49938	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.853300095 CET	443	49938	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.853547096 CET	49938	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.853771925 CET	49938	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.853785038 CET	443	49938	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.871401072 CET	443	49934	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.871594906 CET	443	49934	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.877319098 CET	49934	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.877388000 CET	49934	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.877388000 CET	49934	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.877404928 CET	443	49934	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.877413988 CET	443	49934	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.880115032 CET	49939	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.880160093 CET	443	49939	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.880364895 CET	49939	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.881077051 CET	49939	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.881088972 CET	443	49939	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.916749001 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.917216063 CET	49937	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.917234898 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.917866945 CET	49937	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.917871952 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.945605040 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.945637941 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.945692062 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.945868969 CET	49935	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.945913076 CET	49935	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.945934057 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.945960045 CET	49935	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.945967913 CET	443	49935	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.948952913 CET	49940	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.948978901 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.949126959 CET	49940	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.949282885 CET	49940	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.949294090 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.969520092 CET	443	49936	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.969605923 CET	443	49936	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.969814062 CET	49936	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.969886065 CET	49936	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.969886065 CET	49936	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.969907045 CET	443	49936	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.969917059 CET	443	49936	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.972672939 CET	49941	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.972711086 CET	443	49941	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:44.972853899 CET	49941	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.973088980 CET	49941	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:44.973103046 CET	443	49941	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.058185101 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.058216095 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.058280945 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.058356047 CET	49937	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.058526039 CET	49937	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.058547974 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.058562040 CET	49937	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.058562040 CET	49937	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.058571100 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.058578014 CET	443	49937	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.063348055 CET	49942	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.063410997 CET	443	49942	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.063482046 CET	49942	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.067359924 CET	49942	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.067389011 CET	443	49942	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.617079020 CET	443	49938	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.618141890 CET	49938	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.618165970 CET	443	49938	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.618626118 CET	49938	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.618633986 CET	443	49938	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.657433033 CET	443	49939	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.658016920 CET	49939	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.658039093 CET	443	49939	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.658701897 CET	49939	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.658708096 CET	443	49939	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.692468882 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.693259001 CET	49940	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.693289042 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.693944931 CET	49940	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.693949938 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.724176884 CET	443	49941	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.725718975 CET	49941	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.725740910 CET	443	49941	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.726329088 CET	49941	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.726339102 CET	443	49941	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.756280899 CET	443	49938	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.756550074 CET	443	49938	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.756644011 CET	49938	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.756757021 CET	49938	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.756782055 CET	443	49938	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.756795883 CET	49938	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.756800890 CET	443	49938	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.759777069 CET	49943	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.759814978 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.759896994 CET	49943	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.760148048 CET	49943	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.760158062 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.798935890 CET	443	49939	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.799050093 CET	443	49939	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.799179077 CET	49939	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.799381018 CET	49939	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.799407005 CET	443	49939	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.799417019 CET	49939	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.799422026 CET	443	49939	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.802939892 CET	49944	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.802968979 CET	443	49944	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.803231001 CET	49944	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.803518057 CET	49944	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.803524971 CET	443	49944	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.816739082 CET	443	49942	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.817158937 CET	49942	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.817186117 CET	443	49942	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.817766905 CET	49942	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.817771912 CET	443	49942	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.843993902 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.844022989 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.844084978 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.844119072 CET	49940	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.844196081 CET	49940	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.848702908 CET	49940	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.848748922 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.848795891 CET	49940	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.848813057 CET	443	49940	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.852458954 CET	49945	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.852495909 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.852583885 CET	49945	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.852750063 CET	49945	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.852763891 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.861774921 CET	443	49941	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.862294912 CET	443	49941	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.862350941 CET	49941	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.862385988 CET	49941	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.862399101 CET	443	49941	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.862411022 CET	49941	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.862416029 CET	443	49941	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.864976883 CET	49946	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.864998102 CET	443	49946	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.865107059 CET	49946	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.865314007 CET	49946	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.865322113 CET	443	49946	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.954391956 CET	443	49942	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.954471111 CET	443	49942	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.954545021 CET	49942	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.954722881 CET	49942	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.954751015 CET	443	49942	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.954770088 CET	49942	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.954782963 CET	443	49942	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.957962036 CET	49947	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.957992077 CET	443	49947	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:45.958211899 CET	49947	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.958312035 CET	49947	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:45.958324909 CET	443	49947	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.528085947 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.528934002 CET	49943	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.528970003 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.529755116 CET	49943	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.529767990 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.559355974 CET	443	49944	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.560018063 CET	49944	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.560041904 CET	443	49944	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.560559034 CET	49944	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.560564995 CET	443	49944	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.602901936 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.603749037 CET	49945	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.603769064 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.604242086 CET	49945	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.604253054 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.642138958 CET	443	49946	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.643348932 CET	49946	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.643362045 CET	443	49946	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.643392086 CET	49946	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.643397093 CET	443	49946	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.685672045 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.686036110 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.686095953 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.686148882 CET	49943	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.686213017 CET	49943	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.686425924 CET	49943	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.686446905 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.686469078 CET	49943	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.686475039 CET	443	49943	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.689343929 CET	49948	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.689424038 CET	443	49948	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.689639091 CET	49948	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.689786911 CET	49948	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.689805984 CET	443	49948	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.698283911 CET	443	49944	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.698440075 CET	443	49944	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.698623896 CET	49944	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.698623896 CET	49944	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.698647022 CET	49944	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.698657036 CET	443	49944	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.701411963 CET	443	49947	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.701438904 CET	49949	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.701473951 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.701617002 CET	49949	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.701801062 CET	49949	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.701824903 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.702001095 CET	49947	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.702013969 CET	443	49947	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.702513933 CET	49947	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.702523947 CET	443	49947	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.738871098 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.738903999 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.738956928 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.738977909 CET	49945	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.739069939 CET	49945	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.739361048 CET	49945	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.739377975 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.739402056 CET	49945	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.739411116 CET	443	49945	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.742192030 CET	49950	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.742233992 CET	443	49950	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.742382050 CET	49950	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.742625952 CET	49950	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.742639065 CET	443	49950	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.784941912 CET	443	49946	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.785001993 CET	443	49946	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.785234928 CET	49946	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.785386086 CET	49946	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.785386086 CET	49946	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.785398960 CET	443	49946	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.785407066 CET	443	49946	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.789233923 CET	49951	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.789263010 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.789410114 CET	49951	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.789721012 CET	49951	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.789733887 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.857108116 CET	443	49947	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.857196093 CET	443	49947	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.857304096 CET	49947	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.857806921 CET	49947	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.857806921 CET	49947	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.857824087 CET	443	49947	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.857835054 CET	443	49947	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.869209051 CET	49952	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.869235992 CET	443	49952	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:46.869735003 CET	49952	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.869946003 CET	49952	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:46.869956970 CET	443	49952	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.295380116 CET	49716	80	192.168.2.7	193.122.6.168
Oct 31, 2024 11:00:47.300467968 CET	80	49716	193.122.6.168	192.168.2.7
Oct 31, 2024 11:00:47.469512939 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.470027924 CET	49949	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.470061064 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.470599890 CET	49949	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.470621109 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.482486010 CET	443	49948	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.483850956 CET	49948	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.483913898 CET	443	49948	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.484339952 CET	49948	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.484354973 CET	443	49948	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.491681099 CET	443	49950	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.495800018 CET	49950	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.495831966 CET	443	49950	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.496293068 CET	49950	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.496304989 CET	443	49950	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.553164959 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.555811882 CET	49951	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.555840969 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.556288958 CET	49951	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.556302071 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.604921103 CET	443	49952	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.606502056 CET	49952	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.606502056 CET	49952	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.606514931 CET	443	49952	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.606533051 CET	443	49952	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.607399940 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.607537985 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.607588053 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.607650995 CET	49949	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.607805967 CET	49949	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.607841969 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.607856035 CET	49949	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.607867956 CET	443	49949	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.610995054 CET	49953	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.611038923 CET	443	49953	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.611167908 CET	49953	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.611335039 CET	49953	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.611344099 CET	443	49953	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.628897905 CET	443	49950	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.628993034 CET	443	49950	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.629065990 CET	49950	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.629144907 CET	49950	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.629185915 CET	443	49950	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.629223108 CET	49950	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.629240036 CET	443	49950	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.629878998 CET	443	49948	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.630306959 CET	443	49948	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.630381107 CET	49948	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.630454063 CET	49948	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.630466938 CET	443	49948	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.630496979 CET	49948	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.630507946 CET	443	49948	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.634536982 CET	49954	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.634566069 CET	443	49954	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.634624958 CET	49954	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.635818958 CET	49954	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.635829926 CET	443	49954	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.638268948 CET	49955	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.638309002 CET	443	49955	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.638437033 CET	49955	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.638484955 CET	49955	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.638492107 CET	443	49955	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.690574884 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.690602064 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.690639019 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.690653086 CET	49951	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.690679073 CET	49951	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.690994024 CET	49951	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.690994024 CET	49951	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.691028118 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.691037893 CET	443	49951	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.695100069 CET	49956	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.695143938 CET	443	49956	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.695209026 CET	49956	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.695614100 CET	49956	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.695626974 CET	443	49956	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.740190983 CET	443	49952	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.740315914 CET	443	49952	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.740381956 CET	49952	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.740550995 CET	49952	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.740573883 CET	443	49952	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.740587950 CET	49952	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.740595102 CET	443	49952	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.744117975 CET	49957	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.744153023 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:47.744213104 CET	49957	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.744385004 CET	49957	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:47.744398117 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.378534079 CET	443	49953	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.378647089 CET	443	49954	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.379014015 CET	49953	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.379034996 CET	443	49953	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.379106045 CET	49954	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.379137993 CET	443	49954	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.379493952 CET	49953	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.379501104 CET	443	49953	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.379559040 CET	49954	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.379570007 CET	443	49954	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.398231983 CET	443	49955	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.398787022 CET	49955	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.398804903 CET	443	49955	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.399358034 CET	49955	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.399363995 CET	443	49955	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.438797951 CET	443	49956	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.439380884 CET	49956	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.439413071 CET	443	49956	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.439984083 CET	49956	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.439994097 CET	443	49956	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.501646996 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.502235889 CET	49957	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.502274036 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.502798080 CET	49957	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.502810955 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.512105942 CET	443	49954	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.512177944 CET	443	49954	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.512233019 CET	49954	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.512465000 CET	49954	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.512482882 CET	443	49954	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.512494087 CET	49954	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.512499094 CET	443	49954	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.515790939 CET	49958	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.515825987 CET	443	49958	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.515882015 CET	49958	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.516091108 CET	49958	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.516104937 CET	443	49958	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.517128944 CET	443	49953	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.517230034 CET	443	49953	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.517273903 CET	443	49953	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.517288923 CET	49953	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.517374039 CET	49953	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.517374039 CET	49953	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.517393112 CET	49953	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.517402887 CET	443	49953	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.520176888 CET	49959	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.520207882 CET	443	49959	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.520265102 CET	49959	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.520431995 CET	49959	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.520445108 CET	443	49959	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.537312031 CET	443	49955	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.537377119 CET	443	49955	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.537435055 CET	49955	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.537607908 CET	49955	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.537626028 CET	443	49955	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.537640095 CET	49955	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.537655115 CET	443	49955	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.541404009 CET	49960	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.541438103 CET	443	49960	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.541495085 CET	49960	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.541686058 CET	49960	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.541697025 CET	443	49960	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.575719118 CET	443	49956	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.575788975 CET	443	49956	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.575851917 CET	49956	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.576308012 CET	49956	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.576328039 CET	443	49956	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.576334953 CET	49956	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.576344967 CET	443	49956	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.581316948 CET	49961	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.581355095 CET	443	49961	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.581425905 CET	49961	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.582336903 CET	49961	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.582354069 CET	443	49961	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.639482975 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.639508963 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.639565945 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.639615059 CET	49957	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.639709949 CET	49957	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.639906883 CET	49957	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.639906883 CET	49957	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.639930010 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.639945984 CET	443	49957	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.643275023 CET	49962	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.643326044 CET	443	49962	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:48.643706083 CET	49962	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.644079924 CET	49962	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:48.644093990 CET	443	49962	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.260077953 CET	443	49959	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.261581898 CET	49959	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.261581898 CET	49959	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.261594057 CET	443	49959	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.261609077 CET	443	49959	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.264628887 CET	443	49958	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.269279003 CET	49958	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.269309998 CET	443	49958	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.271348000 CET	49958	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.271354914 CET	443	49958	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.293979883 CET	443	49960	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.294848919 CET	49960	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.294864893 CET	443	49960	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.295458078 CET	49960	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.295465946 CET	443	49960	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.358688116 CET	443	49961	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.359258890 CET	49961	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.359286070 CET	443	49961	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.359846115 CET	49961	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.359852076 CET	443	49961	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.395874023 CET	443	49959	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.396183014 CET	443	49959	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.397181034 CET	49959	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.397294044 CET	49959	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.397308111 CET	443	49959	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.397509098 CET	49959	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.397527933 CET	443	49959	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.401639938 CET	49963	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.401676893 CET	443	49963	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.402734995 CET	49963	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.403126001 CET	49963	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.403136969 CET	443	49963	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.403971910 CET	443	49958	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.404047012 CET	443	49958	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.404232025 CET	49958	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.404232025 CET	49958	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.404264927 CET	49958	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.404274940 CET	443	49958	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.406482935 CET	49964	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.406579971 CET	443	49964	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.406825066 CET	49964	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.406826019 CET	49964	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.406896114 CET	443	49964	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.432109118 CET	443	49960	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.432281971 CET	443	49960	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.432446003 CET	49960	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.432660103 CET	49960	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.432673931 CET	443	49960	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.432728052 CET	49960	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.432734013 CET	443	49960	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.435308933 CET	49965	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.435379028 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.435797930 CET	49965	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.436084032 CET	49965	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.436110973 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.436683893 CET	443	49962	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.437558889 CET	49962	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.437577009 CET	443	49962	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.439351082 CET	49962	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.439358950 CET	443	49962	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.499116898 CET	443	49961	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.499183893 CET	443	49961	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.499268055 CET	49961	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.499519110 CET	49961	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.499519110 CET	49961	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.499541044 CET	443	49961	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.499547005 CET	443	49961	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.505275965 CET	49966	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.505388021 CET	443	49966	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.506191015 CET	49966	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.506553888 CET	49966	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.506586075 CET	443	49966	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.801459074 CET	443	49962	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.801527977 CET	443	49962	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.801604033 CET	49962	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.801861048 CET	49962	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.801884890 CET	443	49962	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.801896095 CET	49962	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.801902056 CET	443	49962	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.805397987 CET	49967	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.805437088 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:49.805531979 CET	49967	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.805711985 CET	49967	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:49.805727005 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.140144110 CET	443	49963	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.140765905 CET	49963	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.140778065 CET	443	49963	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.141401052 CET	49963	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.141406059 CET	443	49963	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.169806957 CET	443	49964	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.170502901 CET	49964	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.170540094 CET	443	49964	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.171139956 CET	49964	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.171153069 CET	443	49964	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.224832058 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.228061914 CET	49965	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.228077888 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.228754044 CET	49965	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.228759050 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.267333031 CET	443	49966	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.268060923 CET	49966	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.268081903 CET	443	49966	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.268526077 CET	49966	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.268532991 CET	443	49966	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.272959948 CET	443	49963	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.273019075 CET	443	49963	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.273081064 CET	49963	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.273402929 CET	49963	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.273416042 CET	443	49963	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.273425102 CET	49963	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.273428917 CET	443	49963	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.277302980 CET	49968	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.277332067 CET	443	49968	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.277380943 CET	49968	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.277745008 CET	49968	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.277755022 CET	443	49968	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.311003923 CET	443	49964	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.311409950 CET	443	49964	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.311465979 CET	49964	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.312011957 CET	49964	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.312038898 CET	443	49964	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.312073946 CET	49964	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.312089920 CET	443	49964	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.322185040 CET	49969	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.322210073 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.322266102 CET	49969	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.322617054 CET	49969	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.322629929 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.366861105 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.366965055 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.367008924 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.367022991 CET	49965	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.367073059 CET	49965	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.367230892 CET	49965	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.367260933 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.367271900 CET	49965	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.367276907 CET	443	49965	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.371386051 CET	49970	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.371428967 CET	443	49970	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.371474981 CET	49970	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.372045040 CET	49970	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.372057915 CET	443	49970	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.405332088 CET	443	49966	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.405404091 CET	443	49966	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.405481100 CET	49966	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.405901909 CET	49966	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.405944109 CET	443	49966	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.405973911 CET	49966	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.405989885 CET	443	49966	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.410871029 CET	49971	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.410902977 CET	443	49971	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.410960913 CET	49971	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.411185026 CET	49971	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.411196947 CET	443	49971	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.561927080 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.562769890 CET	49967	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.562783003 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.563685894 CET	49967	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.563689947 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.699101925 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.699156046 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.699206114 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.703330994 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.703356981 CET	49967	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.706940889 CET	49967	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.708231926 CET	49967	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.708266020 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.708293915 CET	49967	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.708301067 CET	443	49967	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.711698055 CET	49972	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.711744070 CET	443	49972	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:50.717353106 CET	49972	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.717770100 CET	49972	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:50.717789888 CET	443	49972	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.027293921 CET	443	49968	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.027812004 CET	49968	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.027832985 CET	443	49968	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.028388977 CET	49968	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.028397083 CET	443	49968	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.071739912 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.076927900 CET	49969	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.076947927 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.077711105 CET	49969	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.077717066 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.147042036 CET	443	49970	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.151516914 CET	49970	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.151549101 CET	443	49970	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.152267933 CET	49970	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.152273893 CET	443	49970	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.164907932 CET	443	49968	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.164963961 CET	443	49968	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.165091991 CET	49968	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.165244102 CET	49968	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.165258884 CET	443	49968	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.165290117 CET	49968	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.165296078 CET	443	49968	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.167906046 CET	49973	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.167954922 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.168059111 CET	49973	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.168498039 CET	49973	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.168514967 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.169358969 CET	443	49971	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.170178890 CET	49971	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.170197010 CET	443	49971	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.173245907 CET	49971	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.173252106 CET	443	49971	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.215095997 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.215225935 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.215285063 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.215317965 CET	49969	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.215509892 CET	49969	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.215542078 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.215557098 CET	49969	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.215557098 CET	49969	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.215565920 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.215572119 CET	443	49969	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.218332052 CET	49974	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.218373060 CET	443	49974	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.218580961 CET	49974	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.218744993 CET	49974	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.218765020 CET	443	49974	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.288665056 CET	443	49970	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.288748026 CET	443	49970	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.288897038 CET	49970	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.289153099 CET	49970	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.289174080 CET	443	49970	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.289207935 CET	49970	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.289213896 CET	443	49970	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.292038918 CET	49975	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.292098999 CET	443	49975	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.295387030 CET	49975	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.295471907 CET	49975	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.295481920 CET	443	49975	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.308939934 CET	443	49971	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.309068918 CET	443	49971	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.309166908 CET	49971	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.309367895 CET	49971	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.309367895 CET	49971	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.309386969 CET	443	49971	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.309396029 CET	443	49971	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.314327002 CET	49976	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.314393997 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.314517021 CET	49976	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.314966917 CET	49976	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.314984083 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.471990108 CET	443	49972	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.473238945 CET	49972	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.473238945 CET	49972	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.473251104 CET	443	49972	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.473259926 CET	443	49972	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.615277052 CET	443	49972	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.615362883 CET	443	49972	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.615962982 CET	49972	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.616046906 CET	49972	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.616072893 CET	443	49972	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.616139889 CET	49972	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.616146088 CET	443	49972	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.618777037 CET	49977	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.618825912 CET	443	49977	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.618927002 CET	49977	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.619259119 CET	49977	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.619271994 CET	443	49977	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.939137936 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.939800978 CET	49973	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.939893961 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.940315008 CET	49973	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.940330029 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.983453035 CET	443	49974	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.984103918 CET	49974	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.984123945 CET	443	49974	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:51.984786034 CET	49974	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:51.984800100 CET	443	49974	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.066243887 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.066822052 CET	49976	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.066843033 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.067619085 CET	49976	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.067624092 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.078937054 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.079005003 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.079051018 CET	49973	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.079085112 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.079129934 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.079183102 CET	49973	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.079303980 CET	49973	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.079344988 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.079375982 CET	49973	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.079387903 CET	443	49973	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.082767963 CET	49978	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.082811117 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.082875013 CET	49978	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.083039999 CET	49978	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.083054066 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.087052107 CET	443	49975	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.087523937 CET	49975	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.087559938 CET	443	49975	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.088036060 CET	49975	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.088047028 CET	443	49975	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.124175072 CET	443	49974	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.124337912 CET	443	49974	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.124398947 CET	49974	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.124528885 CET	49974	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.124528885 CET	49974	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.124551058 CET	443	49974	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.124561071 CET	443	49974	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.127804041 CET	49979	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.127867937 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.127929926 CET	49979	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.128122091 CET	49979	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.128133059 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.202275038 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.202301025 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.202347994 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.202356100 CET	49976	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.202416897 CET	49976	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.202620029 CET	49976	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.202620029 CET	49976	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.202635050 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.202644110 CET	443	49976	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.205508947 CET	49980	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.205552101 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.205604076 CET	49980	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.205801010 CET	49980	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.205811977 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.231498957 CET	443	49975	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.231647015 CET	443	49975	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.231698036 CET	49975	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.231934071 CET	49975	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.231966019 CET	443	49975	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.231983900 CET	49975	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.231992006 CET	443	49975	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.235810041 CET	49981	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.235853910 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.235918999 CET	49981	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.236110926 CET	49981	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.236123085 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.367551088 CET	443	49977	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.368113995 CET	49977	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.368144989 CET	443	49977	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.368737936 CET	49977	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.368743896 CET	443	49977	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.501636982 CET	443	49977	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.501773119 CET	443	49977	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.501823902 CET	49977	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.502032995 CET	49977	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.502052069 CET	443	49977	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.502063036 CET	49977	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.502068043 CET	443	49977	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.505696058 CET	49982	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.505734921 CET	443	49982	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.505809069 CET	49982	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.506026030 CET	49982	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.506037951 CET	443	49982	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.849067926 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.849711895 CET	49978	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.849731922 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.850380898 CET	49978	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.850392103 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.895518064 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.896194935 CET	49979	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.896220922 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.896748066 CET	49979	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.896754026 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.950068951 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.952425957 CET	49980	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.952452898 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.952752113 CET	49980	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.952758074 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.989789963 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.989814997 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.989875078 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.989932060 CET	49978	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.990061998 CET	49978	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.990295887 CET	49978	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.990312099 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.990324974 CET	49978	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.990329981 CET	443	49978	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.993391037 CET	49983	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.993444920 CET	443	49983	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.993521929 CET	49983	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.993721962 CET	49983	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.993732929 CET	443	49983	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.995013952 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.995534897 CET	49981	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.995553017 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:52.999352932 CET	49981	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:52.999367952 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.034384012 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.034410000 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.034482002 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.034513950 CET	49979	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.034611940 CET	49979	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.034862041 CET	49979	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.034862041 CET	49979	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.034887075 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.034898996 CET	443	49979	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.037769079 CET	49984	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.037831068 CET	443	49984	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.037986040 CET	49984	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.038048029 CET	49984	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.038055897 CET	443	49984	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.086997986 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.087022066 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.087095976 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.087115049 CET	49980	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.087230921 CET	49980	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.087650061 CET	49980	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.087665081 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.087714911 CET	49980	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.087719917 CET	443	49980	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.090456009 CET	49985	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.090478897 CET	443	49985	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.090579033 CET	49985	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.090980053 CET	49985	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.090991974 CET	443	49985	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.135576010 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.135601997 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.135668993 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.135833025 CET	49981	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.136112928 CET	49981	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.136132002 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.136157990 CET	49981	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.136162996 CET	443	49981	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.139349937 CET	49986	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.139370918 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.143464088 CET	49986	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.147367954 CET	49986	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.147418976 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.255907059 CET	443	49982	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.259879112 CET	49982	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.259912968 CET	443	49982	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.260399103 CET	49982	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.260406971 CET	443	49982	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.395478010 CET	443	49982	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.395596981 CET	443	49982	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.399365902 CET	49982	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.556200027 CET	49982	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.556200027 CET	49982	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.556236029 CET	443	49982	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.556247950 CET	443	49982	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.567261934 CET	49987	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.567307949 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.567774057 CET	49987	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.571373940 CET	49987	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.571387053 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.739479065 CET	443	49983	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.740130901 CET	49983	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.740159988 CET	443	49983	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.740632057 CET	49983	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.740637064 CET	443	49983	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.782711983 CET	443	49984	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.783484936 CET	49984	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.783505917 CET	443	49984	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.784065962 CET	49984	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.784079075 CET	443	49984	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.853770971 CET	443	49985	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.854361057 CET	49985	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.854383945 CET	443	49985	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.854940891 CET	49985	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.854948044 CET	443	49985	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.875485897 CET	443	49983	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.875571012 CET	443	49983	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.875626087 CET	49983	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.875858068 CET	49983	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.875876904 CET	443	49983	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.875888109 CET	49983	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.875893116 CET	443	49983	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.879220009 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.879249096 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.879328966 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.879515886 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.879524946 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.905584097 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.906189919 CET	49986	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.906207085 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.906905890 CET	49986	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.906914949 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.983333111 CET	443	49984	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.983427048 CET	443	49984	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.983491898 CET	49984	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.983695030 CET	49984	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.983715057 CET	443	49984	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.983747005 CET	49984	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.983752012 CET	443	49984	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.986865044 CET	49989	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.986912966 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.986972094 CET	49989	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.987162113 CET	49989	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.987174988 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.994609118 CET	443	49985	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.994669914 CET	443	49985	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.994719028 CET	49985	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.994911909 CET	49985	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.994911909 CET	49985	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.994934082 CET	443	49985	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.994937897 CET	443	49985	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.997859001 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.997900963 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:53.997958899 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.998157978 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:53.998168945 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.043057919 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.043081045 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.043131113 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.043148041 CET	49986	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.043189049 CET	49986	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.043560028 CET	49986	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.043576002 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.043586016 CET	49986	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.043591976 CET	443	49986	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.046785116 CET	49991	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.046827078 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.046927929 CET	49991	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.047103882 CET	49991	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.047117949 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.336504936 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.336941004 CET	49987	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.336968899 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.337404013 CET	49987	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.337409973 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.479289055 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.479345083 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.479428053 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.479469061 CET	49987	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.479501009 CET	49987	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.493438005 CET	49987	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.493438005 CET	49987	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.493465900 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.493474960 CET	443	49987	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.500452995 CET	49992	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.500497103 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.500551939 CET	49992	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.501100063 CET	49992	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.501111031 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.628372908 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.629266024 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.629302979 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.630127907 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.630136967 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.757772923 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.760328054 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.760350943 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.763375044 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.763380051 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.766407967 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.791285038 CET	49989	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.791321039 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.791980982 CET	49989	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.791994095 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.802602053 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.804297924 CET	49991	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.804327011 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.805253983 CET	49991	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.805268049 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.881081104 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.881149054 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.881191969 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.881251097 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.881272078 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.881298065 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.881515980 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.881874084 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.882015944 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.882042885 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.882195950 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.882288933 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.882302046 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.882323980 CET	49988	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.882329941 CET	443	49988	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.889260054 CET	49993	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.889302969 CET	443	49993	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.889776945 CET	49993	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.892277956 CET	49993	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.892299891 CET	443	49993	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.927268982 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.927294016 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.927371979 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.927514076 CET	49989	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.927799940 CET	49989	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.927799940 CET	49989	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.927819967 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.927841902 CET	443	49989	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.931302071 CET	49994	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.931360960 CET	443	49994	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.937345028 CET	49994	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.940279961 CET	49994	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.940295935 CET	443	49994	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.948231936 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.948261976 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.948410988 CET	49991	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.948431015 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.948450089 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.948559999 CET	49991	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.948678970 CET	49991	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.948679924 CET	49991	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.948693037 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.948700905 CET	443	49991	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.952277899 CET	49995	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.952318907 CET	443	49995	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:54.955374002 CET	49995	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.961266994 CET	49995	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:54.961292028 CET	443	49995	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.020889997 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.020916939 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.020941973 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.021006107 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.021044970 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.021078110 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.021141052 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.136024952 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.136094093 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.136137009 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.136142015 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.136269093 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.145656109 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.145674944 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.145776987 CET	49990	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.145782948 CET	443	49990	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.150243044 CET	49996	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.150285959 CET	443	49996	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.150382996 CET	49996	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.150698900 CET	49996	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.150708914 CET	443	49996	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.255683899 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.257364988 CET	49992	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.257364988 CET	49992	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.257409096 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.257416964 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.584934950 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.584948063 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.585002899 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.585249901 CET	49992	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.585396051 CET	49992	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.585396051 CET	49992	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.585417986 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.585423946 CET	443	49992	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.587979078 CET	49997	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.588015079 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.588224888 CET	49997	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.588376045 CET	49997	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.588387012 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.721005917 CET	443	49995	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.721491098 CET	49995	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.721501112 CET	443	49995	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.721975088 CET	49995	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.721980095 CET	443	49995	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.722697973 CET	443	49994	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.723170042 CET	49994	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.723227978 CET	443	49994	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.723686934 CET	49994	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.723702908 CET	443	49994	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.725570917 CET	443	49993	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.726022005 CET	49993	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.726030111 CET	443	49993	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.726485968 CET	49993	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.726490974 CET	443	49993	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.855952978 CET	443	49995	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.856033087 CET	443	49995	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.856132984 CET	49995	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.856272936 CET	49995	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.856272936 CET	49995	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.856287003 CET	443	49995	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.856292009 CET	443	49995	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.859762907 CET	49998	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.859791994 CET	443	49998	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.859889030 CET	49998	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.860183954 CET	49998	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.860197067 CET	443	49998	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.861789942 CET	443	49993	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.862030029 CET	443	49994	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.862056017 CET	443	49993	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.862127066 CET	49993	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.862176895 CET	49993	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.862176895 CET	49993	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.862185001 CET	443	49993	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.862191916 CET	443	49993	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.862299919 CET	443	49994	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.862411976 CET	49994	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.862926006 CET	49994	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.862972021 CET	443	49994	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.862989902 CET	49994	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.863007069 CET	443	49994	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.865509987 CET	49999	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.865550995 CET	443	49999	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.865626097 CET	49999	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.866028070 CET	49999	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.866043091 CET	443	49999	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.867273092 CET	50000	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.867304087 CET	443	50000	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.867543936 CET	50000	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.867543936 CET	50000	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.867585897 CET	443	50000	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.914200068 CET	443	49996	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.914756060 CET	49996	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.914767027 CET	443	49996	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:55.915332079 CET	49996	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:55.915338039 CET	443	49996	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.054780960 CET	443	49996	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.054856062 CET	443	49996	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.054934025 CET	49996	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.056067944 CET	49996	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.056067944 CET	49996	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.056081057 CET	443	49996	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.056091070 CET	443	49996	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.061546087 CET	50001	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.061614037 CET	443	50001	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.061685085 CET	50001	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.062741995 CET	50001	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.062772989 CET	443	50001	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.360522985 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.361087084 CET	49997	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.361098051 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.361713886 CET	49997	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.361717939 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.502291918 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.502351046 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.502407074 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.502429008 CET	49997	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.502460957 CET	49997	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.502861023 CET	49997	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.502876997 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.502887011 CET	49997	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.502892017 CET	443	49997	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.617346048 CET	443	49998	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.617959976 CET	49998	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.617984056 CET	443	49998	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.618585110 CET	49998	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.618597984 CET	443	49998	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.628868103 CET	443	49999	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.629301071 CET	49999	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.629313946 CET	443	49999	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.629858017 CET	49999	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.629863024 CET	443	49999	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.657537937 CET	443	50000	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.660016060 CET	50000	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.660058975 CET	443	50000	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.660509109 CET	50000	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.660535097 CET	443	50000	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.755830050 CET	443	49998	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.755913973 CET	443	49998	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.756139040 CET	49998	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.756295919 CET	49998	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.756295919 CET	49998	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.756314039 CET	443	49998	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.756324053 CET	443	49998	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.769134998 CET	443	49999	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.769205093 CET	443	49999	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.769364119 CET	49999	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.769584894 CET	49999	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.769584894 CET	49999	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.769604921 CET	443	49999	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.769617081 CET	443	49999	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.802192926 CET	443	50000	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.802267075 CET	443	50000	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.802433014 CET	50000	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.802551985 CET	50000	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.802568913 CET	443	50000	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.802591085 CET	50000	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.802596092 CET	443	50000	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.814171076 CET	443	50001	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.814677954 CET	50001	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.814743996 CET	443	50001	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.817291975 CET	50001	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.817310095 CET	443	50001	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.952653885 CET	443	50001	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.952826977 CET	443	50001	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.952981949 CET	50001	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.953175068 CET	50001	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.953242064 CET	443	50001	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:56.953285933 CET	50001	443	192.168.2.7	13.107.253.45
Oct 31, 2024 11:00:56.953304052 CET	443	50001	13.107.253.45	192.168.2.7
Oct 31, 2024 11:00:58.433640003 CET	49734	80	192.168.2.7	193.122.6.168
Oct 31, 2024 11:00:58.634426117 CET	80	49734	193.122.6.168	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 10:58:54.440643072 CET	50009	53	192.168.2.7	1.1.1.1
Oct 31, 2024 10:58:54.448626041 CET	53	50009	1.1.1.1	192.168.2.7
Oct 31, 2024 10:58:55.595073938 CET	53389	53	192.168.2.7	1.1.1.1
Oct 31, 2024 10:58:55.602556944 CET	53	53389	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 10:58:54.440643072 CET	192.168.2.7	1.1.1.1	0xa95a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:58:55.595073938 CET	192.168.2.7	1.1.1.1	0x113c	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 10:58:54.448626041 CET	1.1.1.1	192.168.2.7	0xa95a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 10:58:54.448626041 CET	1.1.1.1	192.168.2.7	0xa95a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:58:54.448626041 CET	1.1.1.1	192.168.2.7	0xa95a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:58:54.448626041 CET	1.1.1.1	192.168.2.7	0xa95a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:58:54.448626041 CET	1.1.1.1	192.168.2.7	0xa95a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:58:54.448626041 CET	1.1.1.1	192.168.2.7	0xa95a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:58:55.602556944 CET	1.1.1.1	192.168.2.7	0x113c	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:58:55.602556944 CET	1.1.1.1	192.168.2.7	0x113c	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:59:09.150491953 CET	1.1.1.1	192.168.2.7	0xe18e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:59:09.150491953 CET	1.1.1.1	192.168.2.7	0xe18e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:59:23.206389904 CET	1.1.1.1	192.168.2.7	0x6251	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:59:23.206389904 CET	1.1.1.1	192.168.2.7	0x6251	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:00:04.284749031 CET	1.1.1.1	192.168.2.7	0x7cd5	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 11:00:04.284749031 CET	1.1.1.1	192.168.2.7	0x7cd5	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 11:00:04.284749031 CET	1.1.1.1	192.168.2.7	0x7cd5	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	193.122.6.168	80	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:58:54.461889029 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:58:55.320729017 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:58:55 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 83a55fa35d2db4679bf5321f5eab8b9f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>
Oct 31, 2024 10:58:55.327677965 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 31, 2024 10:58:55.574646950 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:58:55 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 73ae446619c71a046d589faa53a5454d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>
Oct 31, 2024 10:58:57.284074068 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 31, 2024 10:58:57.530654907 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:58:57 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7416d74c198af95c2219dcb6e903dab0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49705	193.122.6.168	80	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:58:58.313500881 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 31, 2024 10:58:59.147571087 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:58:59 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7729381a7a57a5796c860d1024854b04 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49707	193.122.6.168	80	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:58:59.954694033 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:00.800288916 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:00 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 444e6c88ae3a84fa7c141299d22c9fdb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49709	193.122.6.168	80	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:01.557662964 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:02.430973053 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:02 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b1b6c5c2287572a3a6104eb6df6a3893 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49711	193.122.6.168	80	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:03.191597939 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:04.028640985 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:03 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5524f30b2954ac92da7ebf611cc54b5c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49713	193.122.6.168	80	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:04.824198961 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:05.667422056 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:05 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4f3406e3d24964a0e817ee986279b5ac Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49715	193.122.6.168	80	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:06.219441891 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:07.052418947 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:06 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8ed320b87683c5a68a512028c82595c1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>
Oct 31, 2024 10:59:07.395700932 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 31, 2024 10:59:07.639008045 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cba00974cae18a781fe767bc21180478 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>
Oct 31, 2024 10:59:08.487826109 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 31, 2024 10:59:08.732830048 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:08 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0d1558fdb84904fa5bbf4c8200dd407d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49716	193.122.6.168	80	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:06.444144011 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:07.280073881 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 19df4de45f74de6462dcf854db72d9b7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49722	193.122.6.168	80	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:09.511141062 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 31, 2024 10:59:10.358259916 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:10 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: adc01f75bb4b72283240dbc218be8120 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49726	193.122.6.168	80	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:11.140547991 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:12.006644964 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:11 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: aa104dfbdb96630f0cac6245d1a1977b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49728	193.122.6.168	80	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:12.771184921 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:13.617052078 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:13 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 507b16b528b55027dc0d40ae130ad1ca Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49730	193.122.6.168	80	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:14.392796040 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:15.235862970 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:15 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8d3bba52eb37f537fa8894b17aa57585 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49732	193.122.6.168	80	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:16.013030052 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:16.848625898 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:16 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 928a47eb42de69d93d212c0c249f3f2d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49734	193.122.6.168	80	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 10:59:17.600940943 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 10:59:18.431102991 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:18 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2ea3245a5a03372f5bb6b3e29860ac86 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	188.114.97.3	443	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:58:56 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:58:57 UTC	1219	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:58:57 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5612 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BtPWUJtmklm1%2Bs28NnUbA3xggTQsn2HorLr8%2FFSoMaCkjZaZ9AnzXY7snOki2m4HmCo00lRD5IA5i1SO4PrlDJiQ2AnxbcdqWAgqwkj%2BgXhyPZ2CCoccBl2Pyae%2FTfJHtzBdoqBR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca1f7fc86c69-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1252&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2303898&cwnd=251&unsent_bytes=0&cid=332dc715c66d8051&ts=1049&x=0"
2024-10-31 09:58:57 UTC	150	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName
2024-10-31 09:58:57 UTC	209	IN	Data Raw: 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: >Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	188.114.97.3	443	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:58:58 UTC	63	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-31 09:58:58 UTC	1224	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:58:58 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5613 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bb%2BoWwEkzk5H7cs8GZRwKmMHvtj%2BXzN4%2BbszD1zqdLgBsz3H1ythNtS37blg%2Ft3C4C5sKB%2FdTILb7iGfeCOAQlWo3PapArK8Xa36kDOKbbBp3aRZqp3jnhEckw%2FcqZ8LRDrabIeD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca25de6c4782-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1135&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2477331&cwnd=242&unsent_bytes=0&cid=84674c0838eedb80&ts=160&x=0"
2024-10-31 09:58:58 UTC	145	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><Regio
2024-10-31 09:58:58 UTC	214	IN	Data Raw: 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: nName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49706	188.114.97.3	443	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:58:59 UTC	63	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-31 09:58:59 UTC	1224	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:58:59 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5614 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iW4aTIgBp6RWvti3P5O76VBEh4mlyMl%2BV1pXO%2FVIsLXILUCSsHFiinaopvsCUTsIoN0%2B39F0VjoUVl9kw0Iw66PnL3Za4m6OHwKDkVY5Vr%2BIj9wJQ04ze%2FTqdho%2FdihqYU%2BWeEMm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca303b64a922-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1413&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2146775&cwnd=185&unsent_bytes=0&cid=d9e6fb397ce94db8&ts=149&x=0"
2024-10-31 09:58:59 UTC	145	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><Regio
2024-10-31 09:58:59 UTC	214	IN	Data Raw: 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: nName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49708	188.114.97.3	443	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:01 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:59:01 UTC	1222	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:01 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5616 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2YVs9576TLcUM6zDqw%2FBiMbUG6CmSTUWHoG0771%2BnXlKyDGdlN%2F2y0XnWwRIbGSqWTU3LCQDNAxXNPn9z5MmjIsfUEUcV7NvrN1HoWqErDV5Emj%2FFjW%2Fo9vQe9bUnz%2Ftxoq5d7Wi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca3a3f1e6c4f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1140&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2507359&cwnd=244&unsent_bytes=0&cid=a6801fc8fd077375&ts=144&x=0"
2024-10-31 09:59:01 UTC	147	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionN
2024-10-31 09:59:01 UTC	212	IN	Data Raw: 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: ame>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49710	188.114.97.3	443	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:03 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:59:03 UTC	1226	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:03 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5618 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Ffe9miyK6SU2xyFM29j%2F8dza9gU%2FDlc%2FtXHU635tOnqalnRT%2BR9qA%2BVm3DGaSiauUbNMmxPhMuL4Ve328ddCCl8%2F8MUlvRKlae%2FJSTcE9SSQRkvEOnzBivWgRi1zGppz17Kf5RPA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca446ec24696-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1060&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2698974&cwnd=251&unsent_bytes=0&cid=43ea1408501337de&ts=147&x=0"
2024-10-31 09:59:03 UTC	143	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><Reg
2024-10-31 09:59:03 UTC	216	IN	Data Raw: 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: ionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49712	188.114.97.3	443	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:04 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:59:04 UTC	1230	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:04 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5619 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G%2FCDgK6q%2Bkw%2FZ33eWAhLTb6vNmtbBOZ3nKIgz71sdsnJs8H%2Bvs%2BKtTthwMm%2Fpt3wm8IZPPjWwX%2F%2BkYnJn3dj%2Bn%2B2xNKG2NvkvTxZ2bPkwwnXvR7B9cHVNwt0A9ZFIWThenQeByaG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca4e9993e972-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1123&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2553791&cwnd=251&unsent_bytes=0&cid=3a0c2011886b65cd&ts=158&x=0"
2024-10-31 09:59:04 UTC	139	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode>
2024-10-31 09:59:04 UTC	220	IN	Data Raw: 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: <RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49714	188.114.97.3	443	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:06 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:59:06 UTC	1224	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:06 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5621 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PuN4s6mCeX2srAFSzI3wxA0TiCJpVoVILrpQLxyF6vibaP%2BSfYWi5hlKy%2Bns%2F73mrEWmXGZoxSmRYXro%2Fy%2Fh0Rff2sE8CTtdhzFWYWU%2FD0ovxIiLz%2F0j24AoafjS9R9kdUxjQtkg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca58b852e766-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1787654&cwnd=239&unsent_bytes=0&cid=4204a6c12743f5ee&ts=152&x=0"
2024-10-31 09:59:06 UTC	145	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><Regio
2024-10-31 09:59:06 UTC	214	IN	Data Raw: 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: nName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49717	188.114.97.3	443	2004	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:07 UTC	63	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-31 09:59:08 UTC	1222	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:08 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5623 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ljN%2BQeyb0a931KrZDbMiWtJ5plTY7ka1GF%2Be30isBSfXyNcpd7ingV2B9h51Yv%2BAfYLxGg%2Fhjcntb21lfn9KX3il3abRh5Ol%2FTU%2BAWdJExEaSIDXGx3AQPe6HpayPwjSw27GJ33B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca62e81e2cc0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1046&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2714151&cwnd=251&unsent_bytes=0&cid=85ffb5ee3b5adf3a&ts=164&x=0"
2024-10-31 09:59:08 UTC	147	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionN
2024-10-31 09:59:08 UTC	212	IN	Data Raw: 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: ame>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49718	188.114.97.3	443	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:08 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:59:08 UTC	1218	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:08 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5623 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cmiPU%2BAZ9z9mn%2BwFvFvJrhNj9DtI8JQVnuCNpbfEpgc3%2FHaLFmO8wPESXRgD6r5hT8SuyaZeBNYfDM189Q553eB33Ft9AQdlZP9gy7yEVl1SFhBzoMMNw4dZzK9C13K2ogwCt%2Fs6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca6589772c91-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1290&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2145185&cwnd=248&unsent_bytes=0&cid=318a7ac3bf187873&ts=214&x=0"
2024-10-31 09:59:08 UTC	151	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>
2024-10-31 09:59:08 UTC	208	IN	Data Raw: 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49720	188.114.97.3	443	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:09 UTC	63	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-31 09:59:09 UTC	1222	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:09 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5624 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uRZCyt5Q1hmTh3%2BwSdKLdhChm7OxY46qLx1VChudVwbqJvRTh42EJbz%2F01H5DIR9T2S%2B0OhlqgHQw1UQnOiA9d%2FY4EKKanhRI0LYGJ7xG1e0wf8I%2Bh3%2FvdnWg6zFBrgEqXvvVnqG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca6be9ece93e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1969&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1476044&cwnd=244&unsent_bytes=0&cid=569154d70c52eb39&ts=152&x=0"
2024-10-31 09:59:09 UTC	147	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionN
2024-10-31 09:59:09 UTC	212	IN	Data Raw: 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: ame>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49725	188.114.97.3	443	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:10 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:59:11 UTC	1214	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:11 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5626 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NeGW3T4iff1fCxD%2FjDAgT5gtkFxXCUGh9B6tH3pF5aGcBaK72XBCID7liA8B3UEHScly5s7IC1fJ2L5xfTHQtVDXcZOucARSW5rBtKn2fFVUaxYjozBJBUk%2Fevawg5GY5ex60t0D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca760d786c32-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1948&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1477551&cwnd=250&unsent_bytes=0&cid=9e3efb1e485e31b9&ts=154&x=0"
2024-10-31 09:59:11 UTC	155	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texa
2024-10-31 09:59:11 UTC	204	IN	Data Raw: 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: s</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49727	188.114.97.3	443	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:12 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:59:12 UTC	1216	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:12 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5627 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9g7yi8jh0FKvEXsqhX2x%2FwcAD3LmoglV5S7RvXO847XKjYB5g3ebtQ3wTcKoG%2FyaEUFSz8TG7OTF0eEycY1oanWmr4APs%2BJSxobHOoSUu95Ibp6qRMMOX8smnTzBaOOjTYqYg5q3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca804d210b95-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1352&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2106181&cwnd=236&unsent_bytes=0&cid=74ef6cbfdc48f31f&ts=147&x=0"
2024-10-31 09:59:12 UTC	153	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Te
2024-10-31 09:59:12 UTC	206	IN	Data Raw: 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: xas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49729	188.114.97.3	443	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:14 UTC	63	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-31 09:59:14 UTC	1212	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:14 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5629 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1jAdCbUDtbfhMcAhnq3q1WFzjm4cwx64yaF8gNKoITvHCZSyFggAzFsduiBoxYwlRTOXF5Uoa0UZDDidlzbdJhNO6lIUytrWYMEJfLcuBEz3TnAyrCwDFMGaQJrci8r6ixXNb%2BGJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca8a6c7b4629-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1799875&cwnd=251&unsent_bytes=0&cid=6c3f813157fab6b2&ts=149&x=0"
2024-10-31 09:59:14 UTC	157	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas<
2024-10-31 09:59:14 UTC	202	IN	Data Raw: 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: /RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49731	188.114.97.3	443	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:15 UTC	63	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-31 09:59:15 UTC	1220	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:15 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5630 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XwubBLFhWY3gZfduQAGrmP%2F7ioct%2FIx%2FEog8X0OIf3jXWgQkXkdCS%2BxT3gBjCwB0eaQQLz6OIBe98QCU6DQGXD3HxwcT4YJT4EjAx5o1y77SY%2BPFKPTN3ujFFAQNlhqK5zvbVXdR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca948e474672-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2101&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1339500&cwnd=249&unsent_bytes=0&cid=b428b284adf716df&ts=147&x=0"
2024-10-31 09:59:15 UTC	149	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionNam
2024-10-31 09:59:15 UTC	210	IN	Data Raw: 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: e>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49733	188.114.97.3	443	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:17 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:59:17 UTC	1214	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:17 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5632 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cndduFJxutb0ylOM0YtLoBV4fvgivxVvVnJSRxyYYYveB8zkhRqm2iDuTzfGRIgswC2CrY%2B8y0wWB8WkVdGDPqjJB%2FjCbpDomiMxIFKW9usUhZLRYmj7Js9Uza9NGi32ElJG7ttS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2ca9e79b0e79e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1277&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2227692&cwnd=252&unsent_bytes=0&cid=4b0a40c0c4cece48&ts=146&x=0"
2024-10-31 09:59:17 UTC	155	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texa
2024-10-31 09:59:17 UTC	204	IN	Data Raw: 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: s</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49735	188.114.97.3	443	4912	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:59:19 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 09:59:19 UTC	1216	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:59:19 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 5634 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X9QdtgkhTx495PaqJqVLDPbSxDvVRJyOyKjPamZyMyVKLixa1rvJV2LQz7DrpqvNDbyrSHDIS4HJxQEn37kX%2FcT7DRLqWVTvK56HnJ%2BLgw7gb2zybkCFx56vHz%2BQKWvX9hHhuJNc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db2caa87d3b6b34-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1944&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1448000&cwnd=249&unsent_bytes=0&cid=464c41883ed2df5f&ts=144&x=0"
2024-10-31 09:59:19 UTC	153	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Te
2024-10-31 09:59:19 UTC	206	IN	Data Raw: 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: xas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Target ID:	0
Start time:	05:58:51
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\PROFORMA FATURA pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PROFORMA FATURA pdf.exe"
Imagebase:	0x259a4f10000
File size:	970'752 bytes
MD5 hash:	1A74C66D4750248AF37FE8CB959560CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1553505840.00000259B6C6E000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1546995097.00000259A5440000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1547079228.00000259A6CE0000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1553505840.00000259B6CF1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:58:53
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
Imagebase:	0x1f3c3240000
File size:	258'544 bytes
MD5 hash:	2EDD0B288FE2459DA84E4274D1942343
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.3993061592.000001F3C531C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.3993061592.000001F3C50D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:59:04
Start date:	31/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs"
Imagebase:	0x7ff7fdcf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:59:04
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Roaming\ApplicationUrl.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\ApplicationUrl.exe"
Imagebase:	0x28823150000
File size:	970'752 bytes
MD5 hash:	1A74C66D4750248AF37FE8CB959560CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000004.00000002.1687063271.0000028834F61000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000004.00000002.1670314430.0000028825529000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000004.00000002.1687063271.0000028835378000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000004.00000002.1689232405.000002883DD95000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.1670314430.0000028824F90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:59:05
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
Imagebase:	0x1fd73a80000
File size:	258'544 bytes
MD5 hash:	2EDD0B288FE2459DA84E4274D1942343
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000005.00000002.3987174994.0000000140012000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.3988703094.000001FD00257000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.3988703094.000001FD00001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 00007FFAAC3555F9 Relevance: 8.4, Strings: 6, Instructions: 900COMMON

Download Yara Rule

Strings

0WR, xrefs: 00007FFAAC355D29
6H, xrefs: 00007FFAAC355E6A
0WR, xrefs: 00007FFAAC355D62
b4H, xrefs: 00007FFAAC355971
0WR, xrefs: 00007FFAAC355DBE
b4H, xrefs: 00007FFAAC3557D5

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: 6H$0WR$0WR$0WR$b4H$b4H
API String ID: 0-1426279900
Opcode ID: b4e80eac7bbeead092c12806cd832c7668dfe68357db65ec1b4c6d1cbbc3832e
Instruction ID: 61edb7957c7ab36ddbd9a05f609ce59f22c59a36390bb511341d370fd5a177f3
Opcode Fuzzy Hash: b4e80eac7bbeead092c12806cd832c7668dfe68357db65ec1b4c6d1cbbc3832e
Instruction Fuzzy Hash: FB520131A1AF498FEBA8EB288459A75B7E1FF5A300F04417DD44EC3692DE29F84587C1

Function 00007FFAAC359107 Relevance: 3.4, Strings: 2, Instructions: 852COMMON

Download Yara Rule

Strings

(LR, xrefs: 00007FFAAC3598D0
6H, xrefs: 00007FFAAC3595FE

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: 6H$(LR
API String ID: 0-3111670751
Opcode ID: e1d05aa855b9401174497843e894b9b39baa4a1bb055082c33e4b1a23ee164b4
Instruction ID: 437a0bd9c463104a13f372532dbdb12bf32de49e2750043046e8f0e7e4b29ae5
Opcode Fuzzy Hash: e1d05aa855b9401174497843e894b9b39baa4a1bb055082c33e4b1a23ee164b4
Instruction Fuzzy Hash: 12421762A0CB4A8FE744EB2CD8666E9BBD1FF56314F04417DE04EC7293DD24E8068791

Function 00007FFAAC3523E4 Relevance: 2.0, Strings: 1, Instructions: 712COMMON

Download Yara Rule

Strings

`%R, xrefs: 00007FFAAC3525A9

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: `%R
API String ID: 0-3585420134
Opcode ID: 77ed611d940e685d66bc3ea13267033a72ebce464e2fc2d249b238d8cd165c5a
Instruction ID: 51320544476b5921761b80cd903b8b903c51f390bcd593259280072ddbbfaf93
Opcode Fuzzy Hash: 77ed611d940e685d66bc3ea13267033a72ebce464e2fc2d249b238d8cd165c5a
Instruction Fuzzy Hash: 5D228D307199498FEB98EB2CC459E7877E1EF5A310F0580BDE44EC72A2DE25EC468791

Function 00007FFAAC352DB5 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2823f1d1306a27d564f89fbcb46753f2140c196e501d834395684b4f54f00450
Instruction ID: f9f5f9e619877446d1ae3664822fffbcc0d7430159aec6281fe734ebbf24dccf
Opcode Fuzzy Hash: 2823f1d1306a27d564f89fbcb46753f2140c196e501d834395684b4f54f00450
Instruction Fuzzy Hash: 8CF12562B0DE4A8FF798A72C9459AB5B7D1EF96310F1480BED04EC3292DD19EC0683D1

Function 00007FFAAC355F78 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f998e3269f67981ef2c1ada03e4b1fa569ea72af61f4d5491c72df1d21c0b2d
Instruction ID: 30ab59a93beeaa08a564d5922821ab071075c7654996f068109d4dd86ca32415
Opcode Fuzzy Hash: 7f998e3269f67981ef2c1ada03e4b1fa569ea72af61f4d5491c72df1d21c0b2d
Instruction Fuzzy Hash: A1B12D65A0EA8D4FE755E77CC8599E9BFE0DF47310B0881BED04DCB2A3CD18A8098791

Function 00007FFAAC3629ED Relevance: 20.1, Strings: 15, Instructions: 1354COMMON

Download Yara Rule

Strings

hyR, xrefs: 00007FFAAC362C50
hyR, xrefs: 00007FFAAC3634A5
hyR, xrefs: 00007FFAAC3630FB
hyR, xrefs: 00007FFAAC363501
hyR, xrefs: 00007FFAAC363449
hyR, xrefs: 00007FFAAC362C7E
hyR, xrefs: 00007FFAAC362C22
hyR, xrefs: 00007FFAAC363477
hyR, xrefs: 00007FFAAC36352F
hyR, xrefs: 00007FFAAC36341B
hyR, xrefs: 00007FFAAC362CAC
hyR, xrefs: 00007FFAAC36355D
hyR, xrefs: 00007FFAAC362E07
hyR, xrefs: 00007FFAAC3634D3
hyR, xrefs: 00007FFAAC36358B

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: hyR$hyR$hyR$hyR$hyR$hyR$hyR$hyR$hyR$hyR$hyR$hyR$hyR$hyR$hyR
API String ID: 0-1181379541
Opcode ID: c3f3374385cc254bdddd4258f24915fa9eb914102d04172639f3fdc6ce5b8a47
Instruction ID: d9e9ee02e1f6044fcd43bdf962a40f28ede3832f80be247bc24cbcbc82fdd2e2
Opcode Fuzzy Hash: c3f3374385cc254bdddd4258f24915fa9eb914102d04172639f3fdc6ce5b8a47
Instruction Fuzzy Hash: E1821930B0DE4A8FF7A9972C84556BAF7D1EF96314B1485BDD04EC32C2DE29E8468790

Function 00007FFAAC18C798 Relevance: 5.4, Strings: 4, Instructions: 359COMMON

Download Yara Rule

Strings

"9H, xrefs: 00007FFAAC18C84C
r6H, xrefs: 00007FFAAC18C945
\M_H, xrefs: 00007FFAAC18C9DF
b4H, xrefs: 00007FFAAC18C9D3

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: "9H$\M_H$b4H$r6H
API String ID: 0-1137939509
Opcode ID: d191ae9c3535f5bf0ba0898332b8fd21ee705c7686b76f88385438f43db65cb5
Instruction ID: 48586b0603c4e906a4c57b7160c8384610f3092c42e3013bf16de3c1ba2c2d8a
Opcode Fuzzy Hash: d191ae9c3535f5bf0ba0898332b8fd21ee705c7686b76f88385438f43db65cb5
Instruction Fuzzy Hash: 52C1D46150EAC88FE756DB68A8697E8BFE1EF57320F0401EFD089CB1E3DA681456C351

Function 00007FFAAC355088 Relevance: 4.4, Strings: 3, Instructions: 684COMMON

Download Yara Rule

Strings

(LR, xrefs: 00007FFAAC35699B
0WR, xrefs: 00007FFAAC3569D4
0WR, xrefs: 00007FFAAC356948

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: (LR$0WR$0WR
API String ID: 0-1532310460
Opcode ID: 97d6a639de833e05f2b49c892bf044ce8d36068dfa1f14017b6827be9fbeade3
Instruction ID: a5075a6d6cd3aa8443087553d7cebe60e07b20d09c3ac5d8255dcbc6ca260a7e
Opcode Fuzzy Hash: 97d6a639de833e05f2b49c892bf044ce8d36068dfa1f14017b6827be9fbeade3
Instruction Fuzzy Hash: 93221460A19E4A8FF3599B298459979B7E1FF96300F0085BDE48FC3296DE24F80687D1

Function 00007FFAAC35B310 Relevance: 4.3, Strings: 3, Instructions: 560COMMON

Download Yara Rule

Strings

6_H, xrefs: 00007FFAAC35BA8F
, xrefs: 00007FFAAC35B9DD
, xrefs: 00007FFAAC35B6D2

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: $ $6_H
API String ID: 0-1309767198
Opcode ID: 474d6ee6196742daec42c2756835bb2da71e4797a5d6c36180372bfd5c102fdd
Instruction ID: 777931e229665212f2623e4ad8b22235c5aa6f89bed2bebbd86ef941fd2744a1
Opcode Fuzzy Hash: 474d6ee6196742daec42c2756835bb2da71e4797a5d6c36180372bfd5c102fdd
Instruction Fuzzy Hash: EDF1CE71A09D498FFBA4EB2CC459A74B7D1FF5A304B1541BEE08EC72A2DE18EC058791

Function 00007FFAAC36400B Relevance: 4.1, Strings: 3, Instructions: 350COMMON

Download Yara Rule

Strings

r6H, xrefs: 00007FFAAC364102
r6H, xrefs: 00007FFAAC3641D5
r6H, xrefs: 00007FFAAC36411C

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: r6H$r6H$r6H
API String ID: 0-792968923
Opcode ID: 637206c22a3d4855125ca223a58ddbf52138d8ef937f7769adcff6ece49a6e24
Instruction ID: 9673d2a1e111373cf05ecfc6015657d8b8d467a7205431ff2a76950b2f5bb55c
Opcode Fuzzy Hash: 637206c22a3d4855125ca223a58ddbf52138d8ef937f7769adcff6ece49a6e24
Instruction Fuzzy Hash: 88A11871E0DB4A9FF764DB5898515BAF7D1EF56310B14827ED04EC3282EE68E80A83D1

Function 00007FFAAC361705 Relevance: 3.3, Strings: 2, Instructions: 773COMMON

Download Yara Rule

Strings

b4H, xrefs: 00007FFAAC361869
6H, xrefs: 00007FFAAC36187F

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: 6H$b4H
API String ID: 0-2803771573
Opcode ID: 475218c0f65927ce0cd766d57577f1ff8b2fa7823e4db850a02f3821893af672
Instruction ID: b63a4becb9a2090f20387d9f314b5ee45520bf84f7dd0ab517462c36d55a31d0
Opcode Fuzzy Hash: 475218c0f65927ce0cd766d57577f1ff8b2fa7823e4db850a02f3821893af672
Instruction Fuzzy Hash: 31328530A19E598FEB58EB28C455AB9F7E1EF59300F1081ADD04EC7296DE34EC468BD1

Function 00007FFAAC354B81 Relevance: 3.0, Strings: 2, Instructions: 510COMMON

Download Yara Rule

Strings

b4H, xrefs: 00007FFAAC354F2A
d, xrefs: 00007FFAAC354E59

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: b4H$d
API String ID: 0-1243160078
Opcode ID: eccef57e88b2ca636b00c014152fc185d7394f097a8e9f85d6437d8370d6bb42
Instruction ID: 0a8a82b6bef8fc09caa5f199f39b1696409dda344b231e864b2b947157bc6a4c
Opcode Fuzzy Hash: eccef57e88b2ca636b00c014152fc185d7394f097a8e9f85d6437d8370d6bb42
Instruction Fuzzy Hash: 95F1DE31A18A498FE74DDF28C489975B7E1EF96300B1486BDD44ECB297CE35E846CB81

Function 00007FFAAC363C9D Relevance: 2.9, Strings: 2, Instructions: 377COMMON

Download Yara Rule

Strings

hyR, xrefs: 00007FFAAC363F0D
/_H, xrefs: 00007FFAAC363E71

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: hyR$/_H
API String ID: 0-528297638
Opcode ID: 5cb70f08144068d512cbc4019ca3942b38633e91bc66a66793bd342e8a694678
Instruction ID: 77b6fe0838c4c9727161d24d6610a77e4e33525495b3fbf1a9a14ba6c7fdc14f
Opcode Fuzzy Hash: 5cb70f08144068d512cbc4019ca3942b38633e91bc66a66793bd342e8a694678
Instruction Fuzzy Hash: 47A15A21E1DECA8FE799972C94515BAF7E1EF86305B0481BAD04EC7186DD2CE84643E1

Function 00007FFAAC352320 Relevance: 2.8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

(LR, xrefs: 00007FFAAC352647
}J, xrefs: 00007FFAAC3523A2

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: }J$(LR
API String ID: 0-1305449584
Opcode ID: 57c5329cbb854192fbef43a89b0b7eed30ec419bb2141b3329d4d8088b862058
Instruction ID: 25c3ef7784cb95e2f1b250536f15ba28ae390f29a2eb710adf8185b2ae0bbab3
Opcode Fuzzy Hash: 57c5329cbb854192fbef43a89b0b7eed30ec419bb2141b3329d4d8088b862058
Instruction Fuzzy Hash: EE816D70A18D1D8FEBA8EB1C8459B7477D1FFA9311F0480BAE44DC72A6CE25EC458781

Function 00007FFAAC36C654 Relevance: 2.0, Strings: 1, Instructions: 720COMMON

Download Yara Rule

Strings

]:_H, xrefs: 00007FFAAC36C6CE

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: ]:_H
API String ID: 0-1962663964
Opcode ID: 65553243690a0ad53d4b9121913c0373317f07adaa1e2447decbb63c8b28af86
Instruction ID: 92715bfdf8ebe6759ed53f24c1e8231c8f858a3956ffb93c0b7deabe0f31acca
Opcode Fuzzy Hash: 65553243690a0ad53d4b9121913c0373317f07adaa1e2447decbb63c8b28af86
Instruction Fuzzy Hash: 7642817090DB8D8FEB46EF64C8599EABFF0FF16301F0441AAD449C71A2DA389958C791

Function 00007FFAAC2B3ABD Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

:_H, xrefs: 00007FFAAC2B3FEF

Memory Dump Source

Source File: 00000000.00000002.1557304846.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac2b0000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: :_H
API String ID: 0-1200089353
Opcode ID: ee90ab16411befa119a5cac6588192bbc7a233009f11e01a908390273afdd1ac
Instruction ID: bcc39bf59a5de8db52be200c3195904a0ff9ab9195185e98d479e7ec3bdcfa9a
Opcode Fuzzy Hash: ee90ab16411befa119a5cac6588192bbc7a233009f11e01a908390273afdd1ac
Instruction Fuzzy Hash: FA020930D1A61ACFEBA5EB6884557BCB7B1FF5A301F504179D00D93296CF39A989CB80

Function 00007FFAAC35A5FA Relevance: 1.6, Strings: 1, Instructions: 366COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFAAC35AB47

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9de787ecdea9b70af744fbc98e850400c2d1f4e938ba66de8e462e40c815c4a0
Instruction ID: c790d23d6b1f7bbeaf574b65c7efbc94c137b24fd1a66135d5987ef2d2daacf0
Opcode Fuzzy Hash: 9de787ecdea9b70af744fbc98e850400c2d1f4e938ba66de8e462e40c815c4a0
Instruction Fuzzy Hash: 21B12461A0EB4E8FF39597189459B79BBD1EF42310F04427ED48ED72C2DE18E80A93D2

Function 00007FFAAC357130 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

p]R, xrefs: 00007FFAAC3572D5

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: p]R
API String ID: 0-3746448657
Opcode ID: 489b21694cc6013d1bcf44a2153088d88f807006f45dd9ce69e167dbdd796684
Instruction ID: 1f9d36b815cffb03a0f47c32c961b76269cfe56f7fa4a90ca0f6e2b4bd185955
Opcode Fuzzy Hash: 489b21694cc6013d1bcf44a2153088d88f807006f45dd9ce69e167dbdd796684
Instruction Fuzzy Hash: 1E810951A2DF8A8FF358972C985A6B5B7D1DF97310B1482BEE44EC32D3DC18A84643D2

Function 00007FFAAC35ADF0 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFAAC35AFAA

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 5a7bcb999c2c7fd105b484ddd75ce3e9631d0283bed9f2c062823a0af3be6a18
Instruction ID: a24307ef423600b71bfeea0090ea9c306c54d5e751d282f75317f268c9d302fc
Opcode Fuzzy Hash: 5a7bcb999c2c7fd105b484ddd75ce3e9631d0283bed9f2c062823a0af3be6a18
Instruction Fuzzy Hash: 4271E561B1DD4E8FFAA5972C8859A787BC1EF9A710B0440BEE04EC72D2DD09DC0683E1

Function 00007FFAAC182EA1 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

r6H, xrefs: 00007FFAAC182FC4

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: r6H
API String ID: 0-2179486592
Opcode ID: 40a563e979f1c7665bdc25b3fd8ef9f8dd5a57e9167117eba2e82ad877e4d931
Instruction ID: 79d3421d8f68c02bab6cb45dd34b1d4ae0450d2bfa39731614fd11e843ed0b3b
Opcode Fuzzy Hash: 40a563e979f1c7665bdc25b3fd8ef9f8dd5a57e9167117eba2e82ad877e4d931
Instruction Fuzzy Hash: 8F41DC6048F7C15FD3538BB448655927FB59E5712470E81DBC4C5CF0A3E64E585BC322

Function 00007FFAAC18C5F3 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

~M_^, xrefs: 00007FFAAC18C601

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: ~M_^
API String ID: 0-1662397256
Opcode ID: f9382e81931e48340c30e5c43ad02b041e5609cf79c76c701379f1228a2fb46f
Instruction ID: f89aa5bad97063d2a469b4e220ad887d3d2e4243a8cf052b698a7dcb6a06e79b
Opcode Fuzzy Hash: f9382e81931e48340c30e5c43ad02b041e5609cf79c76c701379f1228a2fb46f
Instruction Fuzzy Hash: 2041C671A0E686CFF707977488695B9BBA1BF13310F0481B6D0498B197CE39961AC7D1

Function 00007FFAAC18304F Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

8[R, xrefs: 00007FFAAC183050

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: 8[R
API String ID: 0-2237876593
Opcode ID: ed6a0162c6935d05f8fcb7f046db9e83201443d93546b69286ada0998dd4c5f7
Instruction ID: a452166da795fb071410865ea553f1f3fbb0e32db01f59438f6c5d3f123607e9
Opcode Fuzzy Hash: ed6a0162c6935d05f8fcb7f046db9e83201443d93546b69286ada0998dd4c5f7
Instruction Fuzzy Hash: 3A11E322B0E9898FE766A76C846A9B47BD0DF5632070942FBD44DCB2E2DC1C9C0683C0

Function 00007FFAAC36932A Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

p[J, xrefs: 00007FFAAC36934D

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: p[J
API String ID: 0-1507369466
Opcode ID: 3f9685411cb02a753d25403a45650a28cc6be3a103df14da139604b1a9a03b65
Instruction ID: 3f6e5e8f5da74a639d76e5fae7098eed051a262e08b5ffdd7c70e13fd4fc80a8
Opcode Fuzzy Hash: 3f9685411cb02a753d25403a45650a28cc6be3a103df14da139604b1a9a03b65
Instruction Fuzzy Hash: 5001C070909A4ACFE714DB54C8A5BFDF7A1EF45320F1441BAC00EC72D2DA386888CB90

Function 00007FFAAC355F80 Relevance: .7, Instructions: 712COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274d9b55f3506b064427d478e86ba64ac1e5b47e92a3a5ac0b45613a2bfa07b8
Instruction ID: a273356f8abe74752a09b94ce44a25cb07e64f14845541113274b2ae29256bbc
Opcode Fuzzy Hash: 274d9b55f3506b064427d478e86ba64ac1e5b47e92a3a5ac0b45613a2bfa07b8
Instruction Fuzzy Hash: 00326530A19E5D8FEB94EB288859B69B7E1EF5A310F0481BDD40DC7296CE34EC458BD1

Function 00007FFAAC35D536 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e998ab5d4009f3b3ed30074fdc97e39b1c579b666439bc696554100c5c2899
Instruction ID: 9b958471dfb7aa73e5f2f368035297cf318a4640a3c1a65ba97e0fed98684b47
Opcode Fuzzy Hash: 53e998ab5d4009f3b3ed30074fdc97e39b1c579b666439bc696554100c5c2899
Instruction Fuzzy Hash: 09229470A19E5D8FEB94EB288459A79B7E1FF5A300F1081ADD04EC7296CE34EC45CB91

Function 00007FFAAC2B307C Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557304846.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac2b0000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1adc2b1c6626f86cf0f442b683d2d50ec70fc7d0ae5de5ea72a85fdaa3c4850
Instruction ID: 0f024a6e516eb021c3c7adca48dee2a1a75c1739cb9c8e51338e72ba998ab2b1
Opcode Fuzzy Hash: d1adc2b1c6626f86cf0f442b683d2d50ec70fc7d0ae5de5ea72a85fdaa3c4850
Instruction Fuzzy Hash: A3123D75A19A1ADFFFA4EB5C84857B977A1FF59300F504175C00DE3286DF38A8898B90

Function 00007FFAAC357FB0 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6826f1088fe0c8b5ba14f5b3bfed5001c441945ca0e783413531647136b266cd
Instruction ID: 6d1deaafa9ba58820b0ac202a1a819a3fd1e7f820e838e49cc0315cecffe6576
Opcode Fuzzy Hash: 6826f1088fe0c8b5ba14f5b3bfed5001c441945ca0e783413531647136b266cd
Instruction Fuzzy Hash: EEF19030619E4D8FEB94EF28C459AA9BBE1FF5A300F1440ADD44DC7292CA25EC46C7D1

Function 00007FFAAC36AB98 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee28f24ab0d9792163b1db4810589ce56c0779b926fcc5f2df904144415b173
Instruction ID: dd821a048ae510ea192dec096663e165bff53fcbc1af5dbfa92a4ee06c1039fa
Opcode Fuzzy Hash: 2ee28f24ab0d9792163b1db4810589ce56c0779b926fcc5f2df904144415b173
Instruction Fuzzy Hash: E2F1A07180D7898FE786EB24C859AEABFF0FF16301F0541EBD449C71A2DA389949C791

Function 00007FFAAC355110 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7318d8094b1e9a6e26ed6ee2bb2cc6ccb785fb7e68c0fe1ab5a1dfce1f7ab158
Instruction ID: fb357fdb3c8ddf36122df80f9494742dc82a3bd4febe8d3e2a4cd46372c6248d
Opcode Fuzzy Hash: 7318d8094b1e9a6e26ed6ee2bb2cc6ccb785fb7e68c0fe1ab5a1dfce1f7ab158
Instruction Fuzzy Hash: 85E11B70A1990DCFEF84EF68C499EA9BBE1FF69340B144169E40DD7296CA34E845CBD0

Function 00007FFAAC35E6E6 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2f64dcead853dc0d68d826d8ef9953db008d606be85a0e35cd559db7e31773
Instruction ID: 87b8c029f857bf3fd4c5468c137c5043cd7e8ac99ced1fedaf34deff5effdcdb
Opcode Fuzzy Hash: ca2f64dcead853dc0d68d826d8ef9953db008d606be85a0e35cd559db7e31773
Instruction Fuzzy Hash: 58C1173160DE898FE795D73C8459AB5BBE1EF8A311B0840BED04DC7692CD2CEC4A8791

Function 00007FFAAC35CB40 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fddfdf1bd5a4e5900f90110bb0967371ea9f70b9fc1aba79bcaaafd4549362bf
Instruction ID: b713e23d7d4b774079a07602e8005d56378022acc2d3d0c0afd827e284f2cacf
Opcode Fuzzy Hash: fddfdf1bd5a4e5900f90110bb0967371ea9f70b9fc1aba79bcaaafd4549362bf
Instruction Fuzzy Hash: 2BB1B270B18E1D8FEB58EB6C9459AB9B7E1EF5A310F10417DE00EC3292CE25EC468791

Function 00007FFAAC35D579 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f089a50f88b1c07bea9d75a830ba23b728fea9a122d9e2b9a968a66d0cb290
Instruction ID: c345412388b1200bbaca00ab247a4d6f48c06eea7b8b1f244e7c2ecf2b68b26b
Opcode Fuzzy Hash: 31f089a50f88b1c07bea9d75a830ba23b728fea9a122d9e2b9a968a66d0cb290
Instruction Fuzzy Hash: 86C18030A19E4D8FEB94EB288859A69B7E1FF5A300F0081ADD44DC7296DE34EC45CBD1

Function 00007FFAAC35C86D Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c9e0a8e38340dcd31fb0a6f252d1f7eb910fa630b6a15d89478868d9d9fa2f
Instruction ID: 724e31515ecd4738fd525866efecb80a0a9f498bc6c62bf2eecd622c699c5256
Opcode Fuzzy Hash: b4c9e0a8e38340dcd31fb0a6f252d1f7eb910fa630b6a15d89478868d9d9fa2f
Instruction Fuzzy Hash: 55B14870A1EA898FF755D72C945AAA4BBD0EF5B314F0440BDD08EC7293DD28E84A87D1

Function 00007FFAAC357FF1 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4c9833a572f164f8af62f9a1a208b7320ca3116be339c1db6f3e055b349725
Instruction ID: afe1693e90c997d8651f1bfe4766fa92c1bb6602ac86b09fc3f488cf1529a76c
Opcode Fuzzy Hash: 6a4c9833a572f164f8af62f9a1a208b7320ca3116be339c1db6f3e055b349725
Instruction Fuzzy Hash: 90C15130919A4DCFEB94EF18C859EA9B7E1FF5A300F14406DE44DC7292CA65E84AC7D1

Function 00007FFAAC365ED1 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc75bbdb7aeee653a27d63a6895d45bf0b445ee8cd2deb6376669f3be328374
Instruction ID: c5990d431f562192c3f83957b338ae876ac09b252db497e9bb1476f057ad48ad
Opcode Fuzzy Hash: 7cc75bbdb7aeee653a27d63a6895d45bf0b445ee8cd2deb6376669f3be328374
Instruction Fuzzy Hash: 74B1E17480DB8DCFEB45EB24C859AEABFB0FF16301F0441BAD449C7192DA389559C791

Function 00007FFAAC360DCA Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1dac1e4202b42ae42e3d294011083eed44741c5dc21b31b9556f7c3cefb81e9
Instruction ID: 89f6ae075684933bce6ef544252de720ec0b57fd7f267d74e57594215a892f5d
Opcode Fuzzy Hash: e1dac1e4202b42ae42e3d294011083eed44741c5dc21b31b9556f7c3cefb81e9
Instruction Fuzzy Hash: 0EA18530A19D5DCFEB49EB689459AB9F7E1EF4A310F1041BDD04EC7292CE29E8468790

Function 00007FFAAC35EA64 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2c7e9b32f24a9baa965e96dab35949a3c2f12bcd6ee5c0a2a65744fff10fd1
Instruction ID: bede2b2a83e9ab3fbef8185bf8a4b9997a253b000325a5d2f37d1e0b22548589
Opcode Fuzzy Hash: cc2c7e9b32f24a9baa965e96dab35949a3c2f12bcd6ee5c0a2a65744fff10fd1
Instruction Fuzzy Hash: BE915130B19E1D8FEB98EB1C9459AB9B7E1EF5A700B04417DD05EC3296CE28EC4687D1

Function 00007FFAAC353383 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2a999d6c5b7be49f827665b21cf864426a6c6eb8dc3deaade1c4828776e0e0
Instruction ID: ffa1d0b184ec5a022296a63bb1122faf87cade7312b2d48f406235baabf4c88e
Opcode Fuzzy Hash: dc2a999d6c5b7be49f827665b21cf864426a6c6eb8dc3deaade1c4828776e0e0
Instruction Fuzzy Hash: 0FA16271A18A0D8FEB98EB2CC449AB9B7E1FF59311F1441BDD04ED3292DE34E8458B81

Function 00007FFAAC36CA40 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da0e53979da77a49780cb5d6b5a2fa6a400d3929ac68b6c0da63a07e86ff81c
Instruction ID: 039b7dd3e499b67e02be4b8c0e56cd600d518f39033672ef625913a15243ba7a
Opcode Fuzzy Hash: 9da0e53979da77a49780cb5d6b5a2fa6a400d3929ac68b6c0da63a07e86ff81c
Instruction Fuzzy Hash: 27B18370909A8DCFEB85EF68C8599FABFF0FF19301F0445AAD409C71A2DA34A558C791

Function 00007FFAAC351CF7 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bd5257822f82ba52b46558581fbaa173327a1769615ce28af686eac19a5459
Instruction ID: e4018ff4a6ac5dfd659e9ce7dd2e6385859ea4f35d7375e593c5a092da17b628
Opcode Fuzzy Hash: 64bd5257822f82ba52b46558581fbaa173327a1769615ce28af686eac19a5459
Instruction Fuzzy Hash: 5D91A230A09A498FFB599B1D84457B9B7E1FF59314F1481BDD48EC32D2CE38E88A8791

Function 00007FFAAC351D1D Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1202243e2e2a8e5f53ac45c899753cc6f236a81fed2dcfd78b5dafc494ad006
Instruction ID: c5b23aef27e99010d515c94b993fb3716cc46c08d78c456927b7deb195e93d9b
Opcode Fuzzy Hash: b1202243e2e2a8e5f53ac45c899753cc6f236a81fed2dcfd78b5dafc494ad006
Instruction Fuzzy Hash: 23917F30A09A498FFB58DB1D84557B9B7E1FF59304F5481BDD48EC3292CE38E88A8791

Function 00007FFAAC3627B8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913654566a8343f2cc2567d523bd4ba8dbc60851c462b15f3b182d5f9c1354c5
Instruction ID: 2d7369d4762d10cfae079fd5640ab85f64bf96f863c487b6f66d061b490306b5
Opcode Fuzzy Hash: 913654566a8343f2cc2567d523bd4ba8dbc60851c462b15f3b182d5f9c1354c5
Instruction Fuzzy Hash: 9D817831A0DF868FF355D73C98459A6FBD0EF46310B0985BAD04EC7293DE19E84A8791

Function 00007FFAAC35DEDB Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c2109e4c43ab1fa0b19da123266bcbbb48f8e757291eaa1651003827c7e1e5
Instruction ID: 2a15b68dad8e7e64c47a49156e0a99a101e369046534ee6d731747e2785e36fc
Opcode Fuzzy Hash: e7c2109e4c43ab1fa0b19da123266bcbbb48f8e757291eaa1651003827c7e1e5
Instruction Fuzzy Hash: 4681153050DA4DCFEB95EF28D8599B8BBE0FF56310B0441ADD45EC7292CA29E816CBD1

Function 00007FFAAC18498D Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5645763df85d1e9501badacf7ec3eeb3920110e9895975dfe79f32c1ba14ee
Instruction ID: 082ce75626bca20b05b576dcc35b7d310f87647e441db54c00cf2018a4f12460
Opcode Fuzzy Hash: 7b5645763df85d1e9501badacf7ec3eeb3920110e9895975dfe79f32c1ba14ee
Instruction Fuzzy Hash: A181E470A1991D8FEBA5EB68C455BADB7B1FF59301F5041BAD00EE3291EF34A884CB40

Function 00007FFAAC35D18A Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e931a88c9cf98d08d957c8d54eb9bf77ed4ae5635cbb09f4648de3ffffb3ef
Instruction ID: fde50a5b1968d37f207101d9f133a8d89dea00199a9b5af8d2ecfdaacb84905d
Opcode Fuzzy Hash: f0e931a88c9cf98d08d957c8d54eb9bf77ed4ae5635cbb09f4648de3ffffb3ef
Instruction Fuzzy Hash: 73619370A19E5D8FEBA4DB288855BA4B7E1EF56310F0481BDD00DC7292CE34EC498BD1

Function 00007FFAAC35C942 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c28d0756ac792dc2523f2226f4121113571aa0183a87b1ba9661e38a7ca260
Instruction ID: 8f704f47604588403e86e89ea869b6e9e289716d5bf7bf94a0ab5a171ac90c4d
Opcode Fuzzy Hash: c2c28d0756ac792dc2523f2226f4121113571aa0183a87b1ba9661e38a7ca260
Instruction Fuzzy Hash: B9519170719D498FEB48EB2C9859A75B7D1EF9A314B1441BDE04EC32A3CE29EC468790

Function 00007FFAAC351979 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495e91eb9b04fa246d4362eff308369579180fa9aee4259c66ee83f3fa77a746
Instruction ID: b07377d3a97c2ffa5ca64840d17a484ae1b674cd4fd972e9a8f55cec6899b518
Opcode Fuzzy Hash: 495e91eb9b04fa246d4362eff308369579180fa9aee4259c66ee83f3fa77a746
Instruction Fuzzy Hash: 70512631A0EA898FF75DD72884196BAB7D1EF56310F0441BED04ED72D2DE29E85687C0

Function 00007FFAAC189EFB Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29183baf9971b291fe007b2e6bfd3a722f911aa3636273a8d330ec4c5a194833
Instruction ID: 2f8cf2313157c3f9009a59559696c89c7b85988a859ba870f393e550477f99bc
Opcode Fuzzy Hash: 29183baf9971b291fe007b2e6bfd3a722f911aa3636273a8d330ec4c5a194833
Instruction Fuzzy Hash: 62511A67A0A5594FE701FB2CECA75F9B7A0EF13239B0843B7D04CCA253ED19944D8291

Function 00007FFAAC350430 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77831524d937f7a6d0df2f142e6e0b661bd3f5889a9f28870e8ed92abd77009d
Instruction ID: 69ca2cc2210d461d6e93de42ba42ea908bde6dc73ba38f056ab1545700fc64ba
Opcode Fuzzy Hash: 77831524d937f7a6d0df2f142e6e0b661bd3f5889a9f28870e8ed92abd77009d
Instruction Fuzzy Hash: 2F516962A0DE4E4FE399977C884A9B5BBD1EF8A21070441BED04EC7297DE18AC068391

Function 00007FFAAC356CD5 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1291e5096cdb4a9335cae29aa368d63c356c63ff361a650691e9de29288991e9
Instruction ID: cf9106d1e0f9844b1f48874da277c7c15618e689855ef48642bc05ee7fc9ff9f
Opcode Fuzzy Hash: 1291e5096cdb4a9335cae29aa368d63c356c63ff361a650691e9de29288991e9
Instruction Fuzzy Hash: 78511735A0BE4D8FFBA497298459AA8BBE0EF5A310B1441BDD04DC7392DD14EC0A87D1

Function 00007FFAAC351EF0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fafeeda444de0876b4a84e2c0c753445198fa0d89afae7874dbbd167aaf0f99
Instruction ID: 1e35a33ebb7feb274cfd46ae26770629d3bab9caa554c17c0dcd35e04e4f645e
Opcode Fuzzy Hash: 6fafeeda444de0876b4a84e2c0c753445198fa0d89afae7874dbbd167aaf0f99
Instruction Fuzzy Hash: B051062060AA4A8FF75C972D8059779B7C2EF99344F14817DD48FC76D3CE2CE88A8294

Function 00007FFAAC3564E8 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ba5eb99b09e83260887c830c572c896b02738a9e47abcb25c5cdcc3ebe1b70
Instruction ID: fab25df7c2007906d7cec5a4128dc3de60a66fe832e8bca86b383d780627b535
Opcode Fuzzy Hash: 10ba5eb99b09e83260887c830c572c896b02738a9e47abcb25c5cdcc3ebe1b70
Instruction Fuzzy Hash: 7E51DE70929E4A9FE758DB298485AA6B3E0FF95304F00857DE48EC3285DE24F80687D2

Function 00007FFAAC35BC20 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3288c42e22e9f2710b47a653671914ac1036d6926db80653eb87f4300a4c3940
Instruction ID: bf6b5cf72c73da71c5b3614274a216aacd78ed5807b88737717c3a5e191d51dd
Opcode Fuzzy Hash: 3288c42e22e9f2710b47a653671914ac1036d6926db80653eb87f4300a4c3940
Instruction Fuzzy Hash: FC510D7151EF898FE765DF28841A9A5BBE0EF47305B1445FDC4CDC71A2DA28A80E83E1

Function 00007FFAAC356078 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2f41ba627a4fc7ae881b32f9212424af003cc5fad40d174caca335c37a945c
Instruction ID: d82cda56e002fb8df6a2dc1e1e45c50cf79e3de7091c2114d45b1e2f1b5a69eb
Opcode Fuzzy Hash: fd2f41ba627a4fc7ae881b32f9212424af003cc5fad40d174caca335c37a945c
Instruction Fuzzy Hash: A9416C30B19D1C8FEB94EB6C9459ABDB7E2EF59311B1441AEE00ED3396CE25AC0587D0

Function 00007FFAAC35AC3A Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea322ce96456426c162b8d9174d36e0894c538b624f03218e92fc8e90ffac523
Instruction ID: 49947d1d767038c858b16addc64bdca36f32d31dd4ecec0a98365b6c4198699c
Opcode Fuzzy Hash: ea322ce96456426c162b8d9174d36e0894c538b624f03218e92fc8e90ffac523
Instruction Fuzzy Hash: 6251D42150EBC54FE74697788865AB5BFF0EF57220B0944EED48ACB1A3DD1CA80BD351

Function 00007FFAAC1A1600 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638fb04c39d7392865a55643acd9f7f5ed6d4cfbbabf646f52c0c3764de118ad
Instruction ID: 590f104713d3553c4ba7818bf0c012162f313ed7130a62f28d56fe9780bef4c0
Opcode Fuzzy Hash: 638fb04c39d7392865a55643acd9f7f5ed6d4cfbbabf646f52c0c3764de118ad
Instruction Fuzzy Hash: 1651FA70A4965D8FEB99EB28C899BA9B7F1FF59300F1441E9D00DD72A1CA34AD85CF40

Function 00007FFAAC35BC61 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e4297f5b1e206febe84a8e44cae531de635ab26d98e13a6bca21a6464763b8
Instruction ID: 8312326645e7012c7d6aa24870d550549da67aaf788d869117bc82fd8d474165
Opcode Fuzzy Hash: b2e4297f5b1e206febe84a8e44cae531de635ab26d98e13a6bca21a6464763b8
Instruction Fuzzy Hash: 3851DA7191EF89CFE769EB28841B964BBE0EF57204B1445FDC48DC71A2D918E80D83E1

Function 00007FFAAC18B70D Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222558ef60e2ffd0d4aa43294369709ce0838be3aa25b07539afb96df772e37c
Instruction ID: 243aa9c8f7b0332d1e511e209fab4826e13330f10eb0478fdc4a04b7ed9e595a
Opcode Fuzzy Hash: 222558ef60e2ffd0d4aa43294369709ce0838be3aa25b07539afb96df772e37c
Instruction Fuzzy Hash: 655188A79096558FD706FB6CE8B35E9BBD0EF07325B0882B7E04DCA263DD14A44C8685

Function 00007FFAAC35E0CE Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a950f965c52552424e4be2433acd32e88b3a85c1ca6c65b6c169031e536f4e87
Instruction ID: 2d8c2b71fe22408ad72ff798792912caa94a705869fe4844b4a8229cbd949794
Opcode Fuzzy Hash: a950f965c52552424e4be2433acd32e88b3a85c1ca6c65b6c169031e536f4e87
Instruction Fuzzy Hash: 9451A130618E4DCFEF84EF68C859AA97BE1FF5A314B0441A9E40DC7292CA65E845CBD1

Function 00007FFAAC35AC87 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2805d17b0ae4802fec887aa249ef18da2c5d6b2f6984e0a097a933a5e65d334f
Instruction ID: 65c36cd4c0490eef4e3dca3fd591b949963a20f8c447d38d7c7279b9e31139e2
Opcode Fuzzy Hash: 2805d17b0ae4802fec887aa249ef18da2c5d6b2f6984e0a097a933a5e65d334f
Instruction Fuzzy Hash: 8D41C32160DBC54FE75697388865AA17FF0EF57210B0941EFD48ACB1A3DD28AC0AC351

Function 00007FFAAC3507FE Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e313c98d100782563bb91b011fab4a078b0b94c0239456058b82e6c87eba826c
Instruction ID: 3174d31e35c1fe9ab38722a15ccca312b5f98b99c1b161048004ffddaf620c94
Opcode Fuzzy Hash: e313c98d100782563bb91b011fab4a078b0b94c0239456058b82e6c87eba826c
Instruction Fuzzy Hash: 9E41B23050DA8D8FEB589B1C9449AB9BBE1EF96310F14417EE48DC3292CE36E846C7D1

Function 00007FFAAC35ADC9 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400f507e020e70d479e1ab81c67c010e0940c04dd24756b82e02c6ebf42c921b
Instruction ID: a32e53d7e4c526711f5405062265e280d15acd609e9096c4f7c79420282eee6a
Opcode Fuzzy Hash: 400f507e020e70d479e1ab81c67c010e0940c04dd24756b82e02c6ebf42c921b
Instruction Fuzzy Hash: A131F620B1EE4E8FFA95871D4858A757BC1EF56715B0480BDE08ED72D2DD05EC0993E1

Function 00007FFAAC35D9C9 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68e8db4b98dd32f72bb371456de03ef5edd25a399252cbb2f8f22306261c22a
Instruction ID: ce6c95891c2b0c74e0d86ae08bc6a0f618ed4c8907a0c426f52fcdc783faea41
Opcode Fuzzy Hash: a68e8db4b98dd32f72bb371456de03ef5edd25a399252cbb2f8f22306261c22a
Instruction Fuzzy Hash: 5E419030B1DE5D8FEB98EB289455AA9B7E1EF4A310F1480BDD00EC7296CE24EC4587D1

Function 00007FFAAC182AE6 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c442927d3df8a9892f8ffce85e80e255625540bd62f1721d4f56ed05db4b40e5
Instruction ID: 1038a7e5cbf69804d410611cf49c06c992d31464acdee4af64867f5738a0d076
Opcode Fuzzy Hash: c442927d3df8a9892f8ffce85e80e255625540bd62f1721d4f56ed05db4b40e5
Instruction Fuzzy Hash: 6741E531B0E6498FFB57DB6494A16B8BB92EF67320B4441BEC04ECB1D2CE6C99058780

Function 00007FFAAC365B6F Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fddd5799c3b44c492ade67cf7f4aae29ef52973ff5677953edf35e2591915a6c
Instruction ID: 8caf058f4d760bda9f805fce191352cbc48d304d7a661ca7e2792319168f0408
Opcode Fuzzy Hash: fddd5799c3b44c492ade67cf7f4aae29ef52973ff5677953edf35e2591915a6c
Instruction Fuzzy Hash: D731266190EE868FFB79933894656B6BBE0EF46201B0441BBD04EC75D3CD59D84A8391

Function 00007FFAAC35D365 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c247ac7849d3b1d0aa29355f0f73443543dedf94b61eb9716b51f888f0e113
Instruction ID: bd256a1147f8a4b238f577fdfff6614e400464d64d6cc70cafe2873622f318b9
Opcode Fuzzy Hash: 93c247ac7849d3b1d0aa29355f0f73443543dedf94b61eb9716b51f888f0e113
Instruction Fuzzy Hash: 4B41FC70A1991DCFEF94EB18C895FA8B7A1EF5A314F1081ACD00DD7296CE35EC498B91

Function 00007FFAAC3600EC Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbcd1dae383f166a63debd573a74ba9ea02dfa4ef1265f7fd92e3ae8899bf52
Instruction ID: dfe9985ff509cbd90442eab8447569c18a1ba8e3ef52ecc9fe58226e9ef829a7
Opcode Fuzzy Hash: ffbcd1dae383f166a63debd573a74ba9ea02dfa4ef1265f7fd92e3ae8899bf52
Instruction Fuzzy Hash: 04313E3061DE488FE785EB1C9499A39B7D1EF9A310B5440AEE44EC32A6CE25EC458792

Function 00007FFAAC2B3109 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557304846.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac2b0000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2a1c1163e23afdfe15361c5bd1b257a75252288f35794288489842f129b5fd
Instruction ID: b45c6571943b95d96b0d3c59e396616b925fb6737beb5a9666f21e54bd2c1a7c
Opcode Fuzzy Hash: df2a1c1163e23afdfe15361c5bd1b257a75252288f35794288489842f129b5fd
Instruction Fuzzy Hash: F0413F71D1A64ACAFFA4EB5884457B9B7A1FF5A300F548175D00DA2286CF38A98DCBD0

Function 00007FFAAC35E505 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29692940fe41c94fe2299d7ef4947175ed4ebd81bbbf67ba30b30333451bc8b
Instruction ID: 5f4bbec6171f8ba26f0658b67b2614e1b559719dca940113f127b56ef4519fa1
Opcode Fuzzy Hash: f29692940fe41c94fe2299d7ef4947175ed4ebd81bbbf67ba30b30333451bc8b
Instruction Fuzzy Hash: 5331E63061DE498FE785EB2C9458E75BBE1EF8A310B1445BEE04DC72A6CE28DC458791

Function 00007FFAAC35339C Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5818a44a33bbbbf2f98ddf0f49cfc14ad225534a9e8560767c521b1d439b22ea
Instruction ID: 7baf9871cd43be13243efe32478236f52642344f682ae99642e46ffb333421c8
Opcode Fuzzy Hash: 5818a44a33bbbbf2f98ddf0f49cfc14ad225534a9e8560767c521b1d439b22ea
Instruction Fuzzy Hash: F831C87191CB0C4FEB68EB2CD85A9F9B7E5EB95320F00417FD44ED3252DA20A9494B81

Function 00007FFAAC3550F0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a211b200539d5418bd94bf60d332a96f939981123fc5c6173be88f2c0b4b37
Instruction ID: 4e3cb4cdbb3e985930bf4fdac02c244c53ebe9195b4968b94dc466b20d186874
Opcode Fuzzy Hash: 82a211b200539d5418bd94bf60d332a96f939981123fc5c6173be88f2c0b4b37
Instruction Fuzzy Hash: 1231F87171CE198FDB84EB2C9458AB5B7D1EF9A310B0485BEE04EC32A7CE24E8458780

Function 00007FFAAC35E71F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc3a381798ca03d9b692131e643a8a90d10ef1441cf00184e3d520fb8ef95a5
Instruction ID: da966451225f1c1270ec5af390bf16e399142ffe95c02d3b38e3b977d0292e41
Opcode Fuzzy Hash: 1dc3a381798ca03d9b692131e643a8a90d10ef1441cf00184e3d520fb8ef95a5
Instruction Fuzzy Hash: F831733061AA8D8FE755EB788099A79B7D1FF46300B5444BDD09EC72D2CE2DE846C750

Function 00007FFAAC1829D7 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5a6a572b8e38a525a2c102dc3d1e255ae3331abc24a9068024e2c797e152c6
Instruction ID: 3489917969c8316553c0b919cc3d48a010e11fe2dcb58dbe9256c0768cc54a80
Opcode Fuzzy Hash: 8c5a6a572b8e38a525a2c102dc3d1e255ae3331abc24a9068024e2c797e152c6
Instruction Fuzzy Hash: 40318F70A0D5498FEB5ADB68C4A5AB87BE1EF5A310F1440FDD44ECB2D2C92DA847CB44

Function 00007FFAAC3587D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e691fe6083361b8cd6aac5d875b3cbba4d1148d56d3714eba72111b63273c220
Instruction ID: 352efcca103a76167c85c81e4f19619144881075cb6de51e3a33cf5242a2509f
Opcode Fuzzy Hash: e691fe6083361b8cd6aac5d875b3cbba4d1148d56d3714eba72111b63273c220
Instruction Fuzzy Hash: DB21DB21B19D0E8FFA94E75C8458AB5A2E1FFA9350B54857ED00EC3295CE74EC0987D1

Function 00007FFAAC2B332F Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557304846.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac2b0000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe47c53cf11c40de8b4320e2a3047e9af6a88484e5298ebd10d431ceb714eba
Instruction ID: 93a944bb5d0f2cfb4254d4b99b8c7a739b5b51463ec6fe61d82d9e8ab48ccbeb
Opcode Fuzzy Hash: efe47c53cf11c40de8b4320e2a3047e9af6a88484e5298ebd10d431ceb714eba
Instruction Fuzzy Hash: 99310B71E19A1A8FEFA4EB58C4866AD77B1FF59300F508079D00DE3246CF34A8898BD0

Function 00007FFAAC18CC0F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6afff30bd602400c50a8fb98e443efc6124c6aef7108f974521796312793888
Instruction ID: 48546ec3cdc7652dbe1846d0a616d544d7f0a1b3ef319829636fe8ec6a39326f
Opcode Fuzzy Hash: d6afff30bd602400c50a8fb98e443efc6124c6aef7108f974521796312793888
Instruction Fuzzy Hash: 5E31C871E0E548CFEB42EB68C8589BDBBF0FF1A310F1445AAD009D71A2DB349949CB50

Function 00007FFAAC35C101 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7affc872a09dadc8665f642a74f5bbcfbee36fd9415bc8576779202ef344e2af
Instruction ID: 1ce779a5d3da1e5124f1d70bdf502c16ca0bf96ce2dbad5eecf7db3c37e8eaa7
Opcode Fuzzy Hash: 7affc872a09dadc8665f642a74f5bbcfbee36fd9415bc8576779202ef344e2af
Instruction Fuzzy Hash: 2E21037171DE888FE789E77C9859AB5B7E1EF5A21030441BED00DC72A2C928E90683D0

Function 00007FFAAC360E10 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86eff5535a6c040e53928a048593349b09dd583182076facad5090401068f0fd
Instruction ID: 219a286d0878fc8833771d25bfd2d5f7ef5aaa45cf386723aa3d7978d6d7b39d
Opcode Fuzzy Hash: 86eff5535a6c040e53928a048593349b09dd583182076facad5090401068f0fd
Instruction Fuzzy Hash: E221F73160EF988FE3599778082A676BFE1DF47221B0445BFD08DC7192CD19984683D5

Function 00007FFAAC355120 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5481c18b1edcf58a8459013448a2e9336921cd7c135f566fd737343393c69a94
Instruction ID: 408e3bcbe9b88359048d440c3ce66b9815485baedd084ff590d13d16ad4ba16a
Opcode Fuzzy Hash: 5481c18b1edcf58a8459013448a2e9336921cd7c135f566fd737343393c69a94
Instruction Fuzzy Hash: FF217F30719E0D8FEB94EB2C9498A35B7D1FF99300B5045BDE00EC32A5CE24E8418B81

Function 00007FFAAC18FD01 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76b959779bd76bc8fd7e24fe7b9fb341c48a633a622b62dc562ed7ca63fe259
Instruction ID: eb9481888faf985c35b2d05bf6f6e7dd43505d30cdc27523398dacf9f80baa7c
Opcode Fuzzy Hash: f76b959779bd76bc8fd7e24fe7b9fb341c48a633a622b62dc562ed7ca63fe259
Instruction Fuzzy Hash: 3E41C97090891D8FDBA4EB54C894AE9B7B0EF64301F0041EBD40EA76A1CA75AA85CF90

Function 00007FFAAC3533E0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd922609dafd7747352705418f4e6dbaf2077c4a2805109360e51d0158b06cb5
Instruction ID: e019a90fa7bd3ff0b268a651bc810a2ebb2fd9df7b7a8db0a72c29e63a1eee77
Opcode Fuzzy Hash: cd922609dafd7747352705418f4e6dbaf2077c4a2805109360e51d0158b06cb5
Instruction Fuzzy Hash: 0721657190CA1C9FEB58EA58DC4A9F9B7E4EBA5321F00413FD44ED3211DA31A9498B82

Function 00007FFAAC18A715 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bd56dad813d808dc8af52c567c301a3ade5917b896d736d16061c29b219abb
Instruction ID: 5f89bed5ba78ced9cf61a8ce12e3638d7fb8c4526c6e1eb5561285fac0c3da49
Opcode Fuzzy Hash: 55bd56dad813d808dc8af52c567c301a3ade5917b896d736d16061c29b219abb
Instruction Fuzzy Hash: 0E21277260864DCFEB46EF6CD8525E877A0FF26325F0441B6E00ECA263DE35A449C790

Function 00007FFAAC350510 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fb78d5de603f8c5e1eaaba0984e28fda73324cd3a7064177a8ea375681d0d1
Instruction ID: 3d2ca5cb1a62565b6acbb458f08642d0b18acb9a4e688fd6d2c8e356f3861085
Opcode Fuzzy Hash: 30fb78d5de603f8c5e1eaaba0984e28fda73324cd3a7064177a8ea375681d0d1
Instruction Fuzzy Hash: 35116D22E1DE0D4FF268A66D98499B1F7C1FB86350744827DE00EC329ADE25FC4642D0

Function 00007FFAAC355500 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109392126b74225230c6ab0a2b62d7e803541d265e0fa70023fa5554d5e557a1
Instruction ID: 25252a7d77d5bfdde9dffb9b35c2644b0998b21ea3109e545e6ea3244d8e6f2d
Opcode Fuzzy Hash: 109392126b74225230c6ab0a2b62d7e803541d265e0fa70023fa5554d5e557a1
Instruction Fuzzy Hash: 1D213034615A4E8FEB84EF28C454BAA73A1FF59304F504569E41EC7285DF35E855C780

Function 00007FFAAC35978A Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89acfa4ef508d50bce85bbf64ff6790b5e368cf127298a910d9e3f17abebde3a
Instruction ID: c469450e9628173f5d93f6b9ef37a03777396ecddc12f0f9c61b2ba7717203be
Opcode Fuzzy Hash: 89acfa4ef508d50bce85bbf64ff6790b5e368cf127298a910d9e3f17abebde3a
Instruction Fuzzy Hash: 6921623161DF5D8FEB98EF0C9845AA973E1FB99310F1142AAD40EC3185DA35EC468BC0

Function 00007FFAAC18A78D Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6cc0567f453b53468086dd8e742fdae4e203ae9796ccc782f14856c288788b
Instruction ID: 2f89af1b71eb9ba72f71e1bbc510a47281e4eed4fbf738c40a47e16b6eebcba9
Opcode Fuzzy Hash: ee6cc0567f453b53468086dd8e742fdae4e203ae9796ccc782f14856c288788b
Instruction Fuzzy Hash: 8B21B37260D64DCFEB46EF5CD8569E87BA0FF56325F0842B6E00DC6262DE219459C780

Function 00007FFAAC185518 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72709f0e1e9413830bbd3d3e251a3b85b8afe3eeb246f4c47df08e969623571
Instruction ID: 2eb066c053349c4379ac81bf66ae2eebef88d8d43cbf67a4d9e0363e67ba66ff
Opcode Fuzzy Hash: f72709f0e1e9413830bbd3d3e251a3b85b8afe3eeb246f4c47df08e969623571
Instruction Fuzzy Hash: 54213731B0D68D8EEB12EB6894546F97FA0DF87321F0801BFD04CD6282ED259448C3D0

Function 00007FFAAC184980 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b924015849342ccfdcd9ea0e90d815ce11fd32f701d9a519ab2320967e1c05b
Instruction ID: c4a83b301d459f514fe772a669a4dfd224ce48380234b913e58137302bf6e2e3
Opcode Fuzzy Hash: 1b924015849342ccfdcd9ea0e90d815ce11fd32f701d9a519ab2320967e1c05b
Instruction Fuzzy Hash: 96216970E0960ECFEB55DF58C444ABE7BF0EF5A300F00806AD40AE7291CA38A955DBD0

Function 00007FFAAC185520 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a46982a5a2f57fa8f89eab08827f855e07fc5e77a41f6c0d9f83da8317b6c82
Instruction ID: 5a15f4d3b57d8ed2e5234fd002d4febf151a3a5411f7791bda2f43d04f0d0653
Opcode Fuzzy Hash: 7a46982a5a2f57fa8f89eab08827f855e07fc5e77a41f6c0d9f83da8317b6c82
Instruction Fuzzy Hash: 11212631B0D6898EEB56EB6894546F97FA0DF86310F0440BFD04DDB182ED24A408C7D4

Function 00007FFAAC2B3545 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557304846.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac2b0000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d7942f87368e53b8e23765f6e5b14d4a2d5e7c16595c19fd3c889d59ea4cdf
Instruction ID: aecfb42948c996f66bd918f96371dfa054ac115a8c0bf1ecfefa7b03e026451f
Opcode Fuzzy Hash: 10d7942f87368e53b8e23765f6e5b14d4a2d5e7c16595c19fd3c889d59ea4cdf
Instruction Fuzzy Hash: 4A21C975E19A1A8FEBA4EB5884857BD77A1FF69300F508165D00DE3245CF38A8898BD1

Function 00007FFAAC35CB19 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c96682c740443bfea156f9e6ac808b20231ed8e6732480c405cbab843c8c406
Instruction ID: 2a1d9ba597bc5b9408bd0adfaac52757f46247961001c96520b3af957ccdbad6
Opcode Fuzzy Hash: 3c96682c740443bfea156f9e6ac808b20231ed8e6732480c405cbab843c8c406
Instruction Fuzzy Hash: A701F57250EB5C5EE72A9628AC0B5F27BD4DB97231B01417FE08DC3552E852AC5782E2

Function 00007FFAAC185530 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006d18c9020ec4f0fb54e9a47359b3032a140c2c15c4d93222abfb6dd2ff7686
Instruction ID: 2997c7127c36c81372c57555f833974241e806f09f83cbb9036791bf1dee287e
Opcode Fuzzy Hash: 006d18c9020ec4f0fb54e9a47359b3032a140c2c15c4d93222abfb6dd2ff7686
Instruction Fuzzy Hash: A511E431A0D6898EEB56EB7884546FE7FA0DF4A310F0440BED04DD7192ED25A448C795

Function 00007FFAAC359030 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72739686a262a9ed4c4fca5ca98aa81d88c6fbb590906bb62a623883ead8916a
Instruction ID: 828f968cec6314f92a16387d35a3307ca87c53e762c7b2de1cccbf7a15ed85a6
Opcode Fuzzy Hash: 72739686a262a9ed4c4fca5ca98aa81d88c6fbb590906bb62a623883ead8916a
Instruction Fuzzy Hash: 0601A521629E094FE658A6189449EF7F3D1EBA9314F10463EE44FC3296DD69A80A83C5

Function 00007FFAAC2B3C0B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557304846.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac2b0000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f07bc745aed9ce38d1090a523829ef54318af717de8ea5e42c14bb134144723
Instruction ID: 2b99426a6fb6e8a52107c7638d188c69f424f7e3f74b2261d982f9c90e04b4c3
Opcode Fuzzy Hash: 7f07bc745aed9ce38d1090a523829ef54318af717de8ea5e42c14bb134144723
Instruction Fuzzy Hash: 1E21A330919A1DCEEB98EB68C4956ACB7B1FF59301F944179D00DA3292CF35AC45CB80

Function 00007FFAAC18265C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf856fbff1e898f0758d980a49b5c6f54a2dd608a7d3df8c37464dc30f7f3fc4
Instruction ID: d254a37eee96a36b0a80bde119fd38884bc9c8773149fff6b1001a99b368b22b
Opcode Fuzzy Hash: cf856fbff1e898f0758d980a49b5c6f54a2dd608a7d3df8c37464dc30f7f3fc4
Instruction Fuzzy Hash: 0A110661B0E5864FE35B972884A66B877C2DF9632076905FAD40FCB1D6CD0C9C0683C0

Function 00007FFAAC18B488 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b2e25e815fd80e4fb667ef7cf87e9979265b21b647ebc4893b503bde0a1ad2
Instruction ID: 2365a25fb7a8d270e9188dff59cf38fc2d127e675d814c77d7852c39e3ec5365
Opcode Fuzzy Hash: 15b2e25e815fd80e4fb667ef7cf87e9979265b21b647ebc4893b503bde0a1ad2
Instruction Fuzzy Hash: 9211827190964DCFDB41EF28D895AE97BF0FF1A304F0481A6E41DC6162DE35E448CB81

Function 00007FFAAC2B3650 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557304846.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac2b0000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106687336f97b4802a5acb2f54409e86cab9a3bfc5ff984681df1f3090ad18b7
Instruction ID: 4e9401dc58c08ef463f24d7b6eaa3866ccc7a99de0ea4744317d65de79e50c3c
Opcode Fuzzy Hash: 106687336f97b4802a5acb2f54409e86cab9a3bfc5ff984681df1f3090ad18b7
Instruction Fuzzy Hash: A421DB75E19A5ECFEBA4EB5884457A977B2FF59300F508065D00DE3245CF38A9898BD0

Function 00007FFAAC182B20 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5646760433886e201041e01edca8d693b25b95ed706b86049576da881181e154
Instruction ID: 0c3d733577ac0aac1b91058e0209eee492b53735b8771177097de04013e4ee5c
Opcode Fuzzy Hash: 5646760433886e201041e01edca8d693b25b95ed706b86049576da881181e154
Instruction Fuzzy Hash: 5511CC3570991C8FDB95EF6CD895AA877F2FF69310B1541A9E009DB262DA34EC42CF40

Function 00007FFAAC18D3B8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef7ad5b631fe154c36ee0c73e1e690fabfbbd62bf5f6bde0dd0f4f44ebf516b
Instruction ID: ab157184b555f2c5f19d559d33fc8abb9595afa63a4ff4791d21bc5b9e8ff0de
Opcode Fuzzy Hash: 9ef7ad5b631fe154c36ee0c73e1e690fabfbbd62bf5f6bde0dd0f4f44ebf516b
Instruction Fuzzy Hash: B6212C70A0A65ACFEB21EF24CC987B9B7B0AF56311F0045FAD00D97691CF785A898F44

Function 00007FFAAC18C0FD Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcf10ef4efcb3eb219c6d11b2dbc1e40777a1c532ec46fbaf2e56ad5a3cfd80
Instruction ID: 21e432aaf2b44fc79ad5313b63aea1546092a4501807d9aa22f77102a2a7c327
Opcode Fuzzy Hash: cdcf10ef4efcb3eb219c6d11b2dbc1e40777a1c532ec46fbaf2e56ad5a3cfd80
Instruction Fuzzy Hash: 76119A7190965DCFDB81EF68C855AFA77F0FF16300F0045A6E40DC6292CA30A998CBC0

Function 00007FFAAC356C69 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895a01a6ffb8056e9e877ea4fe9691182440e8df5cf5d5b8e16e1b9dffdae097
Instruction ID: 3858d79024c9214a0d742a6ca6743523bcafa32ba993475c9684857f6be3002e
Opcode Fuzzy Hash: 895a01a6ffb8056e9e877ea4fe9691182440e8df5cf5d5b8e16e1b9dffdae097
Instruction Fuzzy Hash: 8401DB51A1DF494FE795A37C54959F2B7E1DF9621070482BFE00EC329BDC64E84A83C1

Function 00007FFAAC1808A9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568bd29c5f6210a3a8975f7031d7919c46c395bb1c0233d5c4e802827f9e4e9e
Instruction ID: 1afc28c58d895ce84be6464bcf392f353844a1141065a760c194044b7f1350f3
Opcode Fuzzy Hash: 568bd29c5f6210a3a8975f7031d7919c46c395bb1c0233d5c4e802827f9e4e9e
Instruction Fuzzy Hash: 5001D46194F7C84FE34797384C690A5BFB0EF07100B4A00EFD489CB0A3DA2859598352

Function 00007FFAAC1827B0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae61c95acad05913552254ec29ddd33d6671e20bb9e2aa867272ac35e7244f2
Instruction ID: 27c0083efda2e793767a2940049c81e499b46cf66eb6014ceb961ba8045380ec
Opcode Fuzzy Hash: 8ae61c95acad05913552254ec29ddd33d6671e20bb9e2aa867272ac35e7244f2
Instruction Fuzzy Hash: 78111831A0D50ACFEF56EB58C484EB877E1EF26310F0540B6D00DDB2A1CA68ED84DB85

Function 00007FFAAC18CDC1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041421f1895339424134a145cf6c3030b8757b04c65ec89d100bdeebe780d927
Instruction ID: 2c39409a2c0b0d0400679543aaf717c16fab8bf58aaad37b14f7d626857bad91
Opcode Fuzzy Hash: 041421f1895339424134a145cf6c3030b8757b04c65ec89d100bdeebe780d927
Instruction Fuzzy Hash: 1F019E71E0E28DCBF7169B2898292F9BFE0EF07310F4042BAE00DC60C2DA289655C3C0

Function 00007FFAAC2B3B9C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557304846.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac2b0000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfaae5892dcc8928c213b19bf30ad725bd527d85bd03854c0341cd4b52effc67
Instruction ID: cbf1d6861d546832855d64635fdde81fc148bfdb10358da7ce04d227f984cefc
Opcode Fuzzy Hash: dfaae5892dcc8928c213b19bf30ad725bd527d85bd03854c0341cd4b52effc67
Instruction Fuzzy Hash: 4111E63090961ACFEB58DF94C091AFDBBB2EF59340F904078D009A6286CF35AC89CB90

Function 00007FFAAC1826B8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760e35a66e99224a8494669212b58c2075a533572b853e2dc117666341514982
Instruction ID: 576169355380e1bfc80e67172a91f57724c805840de7803312eae0d77b960a18
Opcode Fuzzy Hash: 760e35a66e99224a8494669212b58c2075a533572b853e2dc117666341514982
Instruction Fuzzy Hash: ADF02281B0EA9A0FE2A7933C546637C6B82DFC622071945FAE40DCB28BCD084C0343C1

Function 00007FFAAC2B314D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557304846.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac2b0000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ac11ebbc23184ee482e8fc2b1529bda2967ac4e9fb4af2b8cd33c883e420b7
Instruction ID: 7aae53f6ed5ee745e262830b097df3db9cd9dd2e37a066faa77c9fad0e5df578
Opcode Fuzzy Hash: a6ac11ebbc23184ee482e8fc2b1529bda2967ac4e9fb4af2b8cd33c883e420b7
Instruction Fuzzy Hash: E401B771E1955A8EEBA4EB5884456A977A1FF59300F50817AD00DA2285CF38A9898BD0

Function 00007FFAAC355020 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8e75b89367b2bad8ac9898eff8e0936e8591401a1203a288182a6610fc8cd8
Instruction ID: 201040edb1c96229697ac0e88027d14178fb5f3a73caadf3ac03329a0d97b0dd
Opcode Fuzzy Hash: 3e8e75b89367b2bad8ac9898eff8e0936e8591401a1203a288182a6610fc8cd8
Instruction Fuzzy Hash: 0CF05411F29D0D4EABA8B67D5449DB6E1D1DB99210B50C67EE00FC329ADC69F84943C0

Function 00007FFAAC18C660 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19f8f18b1dc01ef13a013ebfec860a32b97a347a4543b29a1b046719125940f
Instruction ID: 288a18f42a17bdc713312f050749cd1bcf492915d96734f91034abc743d7e081
Opcode Fuzzy Hash: f19f8f18b1dc01ef13a013ebfec860a32b97a347a4543b29a1b046719125940f
Instruction Fuzzy Hash: F8019275E0E649CFE702AB64C8146BAB7B4EF46300F008176E406C729ACE34A619CBD1

Function 00007FFAAC180929 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4591ddf02aac8cfc7bbefb2737314cd7af2c40d0e3182dfb2360b1879cf23169
Instruction ID: 8e7c5f453fa12a4a8d6824c401d68f3189c50288a85d0877ecae62d33423cd52
Opcode Fuzzy Hash: 4591ddf02aac8cfc7bbefb2737314cd7af2c40d0e3182dfb2360b1879cf23169
Instruction Fuzzy Hash: 47F0986299F3C98FE71757605C320A57F70AE07111B5E42D7D488CE4A3D609995CC792

Function 00007FFAAC18536D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aedfba0725cb3d4a81307d7934a397ffd76a1ee02ec318c7f3f2b39aae791b10
Instruction ID: 7a8a2195f7f0304a051e311605bb6e8aa1f5814f0b52f6502114b6a37a12feb3
Opcode Fuzzy Hash: aedfba0725cb3d4a81307d7934a397ffd76a1ee02ec318c7f3f2b39aae791b10
Instruction Fuzzy Hash: 97F0C434A0894DDFEB94EF58C848AAD77E0FF29301F004466E81DD3265DA34E598CB81

Function 00007FFAAC184D1D Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e82dc93592b1e83d2f45bc50742386d5f7cf10d06dca46cb287984afced10fb
Instruction ID: b4f4e41f640c8be13d55c14e49069c1d8cbb32b14b4b75143e0f4b549f823fe6
Opcode Fuzzy Hash: 8e82dc93592b1e83d2f45bc50742386d5f7cf10d06dca46cb287984afced10fb
Instruction Fuzzy Hash: 63F01D30A0960D8FFB51EF68D4496BEB7A0FF59300F108576E81DC2150DE34A2A9CBC1

Function 00007FFAAC369340 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578873c66ac616bb19dfe25e9d1a186c3aa178753fbb86b361f6239b059a5e9b
Instruction ID: 06011c475529d332e9a68a3ec6ec973a3a717203513d47c69e9b1cca182a3c53
Opcode Fuzzy Hash: 578873c66ac616bb19dfe25e9d1a186c3aa178753fbb86b361f6239b059a5e9b
Instruction Fuzzy Hash: ABF09661A195468FE36597A88856BE4F7E0EF45210F0801FFD05EC35D3DD2829458A91

Function 00007FFAAC1826D2 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fecd6d81b4187534b27dd434ba4b209a4f38daae5ad26144d5734004cf29fb3
Instruction ID: d582f702b16c012ca664d2a78f80b1b45a2ddd57f2bd4654d630b5c12467592c
Opcode Fuzzy Hash: 9fecd6d81b4187534b27dd434ba4b209a4f38daae5ad26144d5734004cf29fb3
Instruction Fuzzy Hash: 5FF0EC91B0D9560FD356977C94667B86BC2DF9511071D05FEE04EC7297CD184C0343C0

Function 00007FFAAC184D40 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf39ee6f16ed5dd12a92d23d928c8c3eb887e5ebe06340e951aa6d42bd57a48a
Instruction ID: 8fa34ec5e8e7b76f0cfd321998b0cd897572f9c4f6485dc1f66982de2fdcae08
Opcode Fuzzy Hash: cf39ee6f16ed5dd12a92d23d928c8c3eb887e5ebe06340e951aa6d42bd57a48a
Instruction Fuzzy Hash: 4EF01C70954A0D9FEB91EF68D8896EEBBE0FF18304F408476E80DD2150DE34A6A4CBC1

Function 00007FFAAC362A00 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c2ac64ca2607167240ed301c163b39690ef9e787a7cd15560ce3e0a6f47cb8
Instruction ID: 4f71f69880b74ca7544415017fd3e61fd4b18a54fb52dc722650296a0d886dbd
Opcode Fuzzy Hash: 50c2ac64ca2607167240ed301c163b39690ef9e787a7cd15560ce3e0a6f47cb8
Instruction Fuzzy Hash: 33E0D830719A058AF774127D640C673E2C0EB59325F11C536D00CC2284DDA894858790

Function 00007FFAAC360C2E Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49bb4502a0a6ac32d1b4411d3ece22123080af2a81c22304e7370966b3a394d
Instruction ID: 8d032299a2d17a5961df3764ca8624975fff6da566183346bb9f9ea37389e521
Opcode Fuzzy Hash: e49bb4502a0a6ac32d1b4411d3ece22123080af2a81c22304e7370966b3a394d
Instruction Fuzzy Hash: F7D01200F2DC1D4EA948737834295BDD1C2CBCA61079094B9D40DC328ADD1CDC4603D0

Function 00007FFAAC35A74C Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b57596afbb7c0570c6d81c9fbd0e5aaa0a64e3b926fbbf144c7896f498c0b3
Instruction ID: 8ca49785c5f7561504472a8e6342d2dbe0cd231b3bae87653f546f64883392ce
Opcode Fuzzy Hash: e6b57596afbb7c0570c6d81c9fbd0e5aaa0a64e3b926fbbf144c7896f498c0b3
Instruction Fuzzy Hash: 2AC02B42F00606CBF2841F88004D33046C1DF94200F00803CC04EC31C3CE24880A03E0

Function 00007FFAAC182900 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb87e6e2818e86bc39935ff6e79701f7f5f0653d0e47934e89389a38e8dd1a5f
Instruction ID: fc456ac3e1453f27329e308e1197735e0bcfaca9c93e2fdcef8c45c3190b9a13
Opcode Fuzzy Hash: fb87e6e2818e86bc39935ff6e79701f7f5f0653d0e47934e89389a38e8dd1a5f
Instruction Fuzzy Hash: 57B01230C0C016CFEB518B64C00437D75B0AB29320F28003BD00DE3180CFAC84418F85

Non-executed Functions

Function 00007FFAAC359120 Relevance: 1.8, Strings: 1, Instructions: 550COMMON

Download Yara Rule

Strings

6H, xrefs: 00007FFAAC3595FE

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: 6H
API String ID: 0-795073523
Opcode ID: c20e2ea9fdc14bcede0b76c6e5e567965e7eeb86b686e870fb43d311af6d4a9a
Instruction ID: 7a2ce842c544a9aebf21c2e68bbb5f9c7b5855fa4d20d76397d4105148e881f9
Opcode Fuzzy Hash: c20e2ea9fdc14bcede0b76c6e5e567965e7eeb86b686e870fb43d311af6d4a9a
Instruction Fuzzy Hash: C2021A6290D7858FE704EB6CD8669E9BBD1EF46314F0841BEE04EC7293DD24E84A87D1

Function 00007FFAAC359190 Relevance: 1.8, Strings: 1, Instructions: 501COMMON

Download Yara Rule

Strings

6H, xrefs: 00007FFAAC3595FE

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: 6H
API String ID: 0-795073523
Opcode ID: 1ec0cc9c96392999a27ccbc06702c889837ae40f60b61a6690bd37baf102a6b5
Instruction ID: e3cce73b3d4c1816d13c43d02c211aec952cc6b4ff4e06e52599e22e3b81d9c0
Opcode Fuzzy Hash: 1ec0cc9c96392999a27ccbc06702c889837ae40f60b61a6690bd37baf102a6b5
Instruction Fuzzy Hash: F6F1187190DB898FE704EB68D856AA9BBD1FF46314F1841BEE04E87293DD24E806C7D1

Function 00007FFAAC1866F3 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa135892bfdf63a1372e7b06a6625b299c777955f831c19064245480e785eb69
Instruction ID: e8035df1bc215c9613d68fbf83325969e04277917cc2cae96af815d4c2a602d3
Opcode Fuzzy Hash: fa135892bfdf63a1372e7b06a6625b299c777955f831c19064245480e785eb69
Instruction Fuzzy Hash: 9D51CF97B1992D4997003AFDBC968FAB700CF83736B04C37BE289CC1938D15548E82DA

Function 00007FFAAC356FFA Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de7a6ac284e102c3e1a87c29981b513779e6e1b16cb369e66efee44a70378f1
Instruction ID: 984c323a40d79263226bd0a864aba133728783b3abb40a2667fb8dc087282183
Opcode Fuzzy Hash: 4de7a6ac284e102c3e1a87c29981b513779e6e1b16cb369e66efee44a70378f1
Instruction Fuzzy Hash: 8E21045764EBB129A301767CFC128D6BF04DE8323A328827FD589CA553CD16A09EC2D6

Function 00007FFAAC36C5C0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6328a7e64182c550e3eb7e6cd937848ef77b8864f39e62f002b4ddb9872660ed
Instruction ID: dd82d58d06c11f545aa969c19c15a6029201c9fa7b91a5e1eacd3acc7c766707
Opcode Fuzzy Hash: 6328a7e64182c550e3eb7e6cd937848ef77b8864f39e62f002b4ddb9872660ed
Instruction Fuzzy Hash: 0221029284E7C24FD7038B785C765A27FB0AF1321471E55CBC8C08F1A7E1189A5AE372

Function 00007FFAAC1802CD Relevance: 7.6, Strings: 6, Instructions: 120COMMON

Download Yara Rule

Strings

-e, xrefs: 00007FFAAC180399
H1e, xrefs: 00007FFAAC1802F9
/e, xrefs: 00007FFAAC180319
8,e, xrefs: 00007FFAAC180359
(0e, xrefs: 00007FFAAC180379
P/e, xrefs: 00007FFAAC180349

Memory Dump Source

Source File: 00000000.00000002.1556575913.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac180000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: (0e$8,e$H1e$P/e$-e$/e
API String ID: 0-1781137769
Opcode ID: 86361819bb2d626e0484dc1993765f0ff69a22359ed3d986bf1a7cd71495cb2a
Instruction ID: ca4f54807deee67b07a3b6018fa6130fc1a5bf89a3ebaab4c36464aabeb1f7b7
Opcode Fuzzy Hash: 86361819bb2d626e0484dc1993765f0ff69a22359ed3d986bf1a7cd71495cb2a
Instruction Fuzzy Hash: 31419053E4FAC58FF2538AD91865138AE94EF63640B18C0BBD58C4B5D7A945EA0DC3C2

Function 00007FFAAC3560A8 Relevance: 6.3, Strings: 5, Instructions: 4COMMON

Download Yara Rule

Strings

6_H, xrefs: 00007FFAAC35BA8F
, xrefs: 00007FFAAC35B9DD
x!R, xrefs: 00007FFAAC35B8F4
(LR, xrefs: 00007FFAAC35B9B1
0#R, xrefs: 00007FFAAC35B5CC

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: $(LR$0#R$x!R$6_H
API String ID: 0-780580318
Opcode ID: 10492b82161fb106a14394f70f55787502b827c90b26217fe538af2c0aee84a3
Instruction ID: 49706cc6154e6bfdb77c1a29700620019d169c579c7e21de792c64f49499c647
Opcode Fuzzy Hash: 10492b82161fb106a14394f70f55787502b827c90b26217fe538af2c0aee84a3
Instruction Fuzzy Hash:

Function 00007FFAAC3606E0 Relevance: 5.1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

Strings

8hJ, xrefs: 00007FFAAC36072C
8hJ, xrefs: 00007FFAAC36073F
8hJ, xrefs: 00007FFAAC3606F8
8hJ, xrefs: 00007FFAAC3606E5

Memory Dump Source

Source File: 00000000.00000002.1557688249.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac350000_PROFORMA FATURA pdf.jbxd

Similarity

API ID:
String ID: 8hJ$8hJ$8hJ$8hJ
API String ID: 0-3897491243
Opcode ID: 87da7ea92f8caa2dc3890381ffe2eea54972356fb7ecc16e76c20fa27f5ae692
Instruction ID: ed53ceac275246540913b44c8e25d3cf796eacbcd7c50b794c22c3b4d3b31ce0
Opcode Fuzzy Hash: 87da7ea92f8caa2dc3890381ffe2eea54972356fb7ecc16e76c20fa27f5ae692
Instruction Fuzzy Hash: E5018952A0EF8A8FE3A48B2C1846612FB95EF66210F0545BEC08D87043D921E809C7D5

Analysis Process: MSBuild.exePID: 2004, Parent PID: 4056COMMON

Executed Functions

Function 00007FFAAC16AACC Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

b4H, xrefs: 00007FFAAC16ABE4

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: b4H
API String ID: 0-3530936433
Opcode ID: b6cdd1efb79650076d921371dccb308b706ddbd081cce0670a822de07ce21a63
Instruction ID: 4351f3bb618b5894f4b2f7e0ccc72c5252aca1afcc2cbcba2be42bb1fc513d0a
Opcode Fuzzy Hash: b6cdd1efb79650076d921371dccb308b706ddbd081cce0670a822de07ce21a63
Instruction Fuzzy Hash: 28911A70D0961A8FEB54EF68C455BEDB7B1FF55300F1082A9D51EE7292CB389985CB80

Function 00007FFAAC16A5FF Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3f0963c69d698f0be83970a37182f99d1459500d6beb167cdb74db510b857e
Instruction ID: 109424210d40f26acc836091341085d5490e226ae20c5848db57ae5689831a19
Opcode Fuzzy Hash: cb3f0963c69d698f0be83970a37182f99d1459500d6beb167cdb74db510b857e
Instruction Fuzzy Hash: 30810570D09A1D8FEB95EF68C845AE9FBF0EF1A301F5041AAD04DE7252DB34A985CB40

Function 00007FFAAC16AD61 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb8808fbe7b35793bc6c0859cc5d694fda1ad409e62bff71e96d976a6855afc
Instruction ID: 1a0151c1f7b84e5d77afca97139c3c91ff88e444cd6205ec3301ca805c0c7ac8
Opcode Fuzzy Hash: ceb8808fbe7b35793bc6c0859cc5d694fda1ad409e62bff71e96d976a6855afc
Instruction Fuzzy Hash: 8F015231D1921E8AEB50EFA5C440BFEB2B1EF86300F008139C22CA31D5CB39A589CF80

Function 00007FFAAC164E2A Relevance: 4.0, Strings: 3, Instructions: 256COMMON

Download Yara Rule

Strings

"rH, xrefs: 00007FFAAC164ED0
O_H, xrefs: 00007FFAAC165051
6H, xrefs: 00007FFAAC164E88

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: 6H$"rH$O_H
API String ID: 0-3520307691
Opcode ID: 5a2c32e4f1721a2d89ebfc57e8890ac0cf887eb7776eb433950e1fd4f9f356f4
Instruction ID: b95cc75b859b0692a58e1fbe12e3ac5a099ec7216b79b7ec39ad9051a48e89da
Opcode Fuzzy Hash: 5a2c32e4f1721a2d89ebfc57e8890ac0cf887eb7776eb433950e1fd4f9f356f4
Instruction Fuzzy Hash: D5913C70A09A5D8FEB95EB68C455BACBBF1FF69300F5040EED04EE7251DA349885CB41

Function 00007FFAAC1608D3 Relevance: 2.8, Strings: 2, Instructions: 332COMMON

Download Yara Rule

Strings

;P_^, xrefs: 00007FFAAC160901
K;P, xrefs: 00007FFAAC16096F

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: ;P_^$K;P
API String ID: 0-3202807064
Opcode ID: 730d12a209504a6e819e546fd8f1dde860c1c5f7c508ad902f80aa08d9eaee99
Instruction ID: 7b565eead722923f805de6e5f31ce7ccfed30a5954fd49d9a864786c24c1b6b0
Opcode Fuzzy Hash: 730d12a209504a6e819e546fd8f1dde860c1c5f7c508ad902f80aa08d9eaee99
Instruction Fuzzy Hash: 01B13975A0891C8FDB94EBACD885BEDB7B1FF59311F0041BAE14DD7252CA34A885CB90

Function 00007FFAAC1608D8 Relevance: 2.8, Strings: 2, Instructions: 326COMMON

Download Yara Rule

Strings

;P_^, xrefs: 00007FFAAC160901
K;P, xrefs: 00007FFAAC16096F

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: ;P_^$K;P
API String ID: 0-3202807064
Opcode ID: dd2e43c357381c592b907cb845f55f2fc83fdda0c2e43164cf6bf13efee42fb2
Instruction ID: 64f4e2f35f4921cc7c3e829fea485a93077c9b6bdd9ffcef4544a931abf52abb
Opcode Fuzzy Hash: dd2e43c357381c592b907cb845f55f2fc83fdda0c2e43164cf6bf13efee42fb2
Instruction Fuzzy Hash: C2B14975A0891C8FDB94EBACD885BEDB7B1FF59311F0041BAE04DD7252CA34A885CB90

Function 00007FFAAC1608E8 Relevance: 2.8, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

;P_^, xrefs: 00007FFAAC160901
K;P, xrefs: 00007FFAAC16096F

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: ;P_^$K;P
API String ID: 0-3202807064
Opcode ID: 7d595ee580a7b12a491d86d10a6d90b3e39aed48eeb0aa9a7c204fb00eb391e0
Instruction ID: 954d4d4cb826604d25a7b98e464cbd0d71132a2813b923a3e8c255fdfb52f65c
Opcode Fuzzy Hash: 7d595ee580a7b12a491d86d10a6d90b3e39aed48eeb0aa9a7c204fb00eb391e0
Instruction Fuzzy Hash: 51A11875A0891C8FDB94EBACD885BEDB7B1FF59311F0045BAE14DD7252CA34A885CB80

Function 00007FFAAC1608F8 Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

;P_^, xrefs: 00007FFAAC160901
K;P, xrefs: 00007FFAAC16096F

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: ;P_^$K;P
API String ID: 0-3202807064
Opcode ID: e3b4a38f4cf7df2f887a16ee1f2e0cc0ba71c851004525deef043e35e68e2dd7
Instruction ID: 080aa513a0688781be45a6ec6957b6c3759f4146d588eaac938bae3e64949c06
Opcode Fuzzy Hash: e3b4a38f4cf7df2f887a16ee1f2e0cc0ba71c851004525deef043e35e68e2dd7
Instruction Fuzzy Hash: 7CA12875A0891C8FDB94EBACD885BEDB7B1FF59311F0041BAE04DD7252CA34A885CB80

Function 00007FFAAC16460A Relevance: 2.8, Strings: 2, Instructions: 259COMMON

Download Yara Rule

Strings

6H, xrefs: 00007FFAAC164668
"rH, xrefs: 00007FFAAC1646B0

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: 6H$"rH
API String ID: 0-1209893370
Opcode ID: d0950e8b7cf3633b10f781aaf16d7bc5d7649387b7dc949b8381077934d24010
Instruction ID: a177b491b005db7ca2dda91fc9edaccf06a35226b273c310d2092ed9b72c88a6
Opcode Fuzzy Hash: d0950e8b7cf3633b10f781aaf16d7bc5d7649387b7dc949b8381077934d24010
Instruction Fuzzy Hash: A2A12C70A09A5D8FEB99EB68C455BACBBF1FF69300F5040AED04EE7251DA349985CB40

Function 00007FFAAC16564A Relevance: 2.8, Strings: 2, Instructions: 259COMMON

Download Yara Rule

Strings

"rH, xrefs: 00007FFAAC1656F0
6H, xrefs: 00007FFAAC1656A8

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: 6H$"rH
API String ID: 0-1209893370
Opcode ID: bd88ff52dfed402875a791d6880fb8e7f12563e7b8d8addcbda1ac6004739c61
Instruction ID: fbaa5cf48d5f374116bab545451a23fffc1cba70550a37c03995dc00cfbe8273
Opcode Fuzzy Hash: bd88ff52dfed402875a791d6880fb8e7f12563e7b8d8addcbda1ac6004739c61
Instruction Fuzzy Hash: 93A13AB0A09A5DCFEF95EB68C455BA8BBF1FF69304F5040AED04EE7651CA349885CB40

Function 00007FFAAC16523A Relevance: 2.8, Strings: 2, Instructions: 257COMMON

Download Yara Rule

Strings

6H, xrefs: 00007FFAAC165298
"rH, xrefs: 00007FFAAC1652E0

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: 6H$"rH
API String ID: 0-1209893370
Opcode ID: 481d77ceeaae1c045c43dad91ab9afa8d99783104ca9b6f0e1da295350256019
Instruction ID: 428cae45abe6e7d92957cd384ca8a8abdeabbe2dcdf829d9f541fc099c166f52
Opcode Fuzzy Hash: 481d77ceeaae1c045c43dad91ab9afa8d99783104ca9b6f0e1da295350256019
Instruction Fuzzy Hash: E0914BB0A09A1D8FEF95EB68C455BA8BBF1FF59304F5040EED04EE7252DA349885CB41

Function 00007FFAAC1641FA Relevance: 2.7, Strings: 2, Instructions: 240COMMON

Download Yara Rule

Strings

6H, xrefs: 00007FFAAC164258
"rH, xrefs: 00007FFAAC1642A0

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: 6H$"rH
API String ID: 0-1209893370
Opcode ID: 446623633a9a5f41234a238e660b9b4ac312882bcef1b131a887842ff0e814b4
Instruction ID: e0ae51d90cadeb63549a663f2365464bf656297cb4f75b7322d64da8b9e3e368
Opcode Fuzzy Hash: 446623633a9a5f41234a238e660b9b4ac312882bcef1b131a887842ff0e814b4
Instruction Fuzzy Hash: B5914DB0A09A5DCFEB95EB68C455BA8BBF1FF59300F5040AED04EE7291DE349884CB41

Function 00007FFAAC164A1A Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

"rH, xrefs: 00007FFAAC164AC0
6H, xrefs: 00007FFAAC164A78

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: 6H$"rH
API String ID: 0-1209893370
Opcode ID: e15ffe91d0ec98158daceb23571fb762038bfcb6deb3207506978c52ebbc287b
Instruction ID: 9c7a070a3147f88486548b19ab9bbb1f2047b4e2204c4cb423026955372e7efb
Opcode Fuzzy Hash: e15ffe91d0ec98158daceb23571fb762038bfcb6deb3207506978c52ebbc287b
Instruction Fuzzy Hash: 06914EB0A09A1D8FEB95EB68C455BACBBF1FF59300F5040AED04EE7251DE349884CB41

Function 00007FFAAC163637 Relevance: 2.7, Strings: 2, Instructions: 215COMMON

Download Yara Rule

Strings

6H, xrefs: 00007FFAAC163638
"rH, xrefs: 00007FFAAC163680

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: 6H$"rH
API String ID: 0-1209893370
Opcode ID: 9004453221c1a082455dd0ecde1c8b02254f06dddb54e774b81b52c289c37e6f
Instruction ID: f7f4889740e4401e8d57191906e1dd740243790f79274ab0867640ccc14b8b82
Opcode Fuzzy Hash: 9004453221c1a082455dd0ecde1c8b02254f06dddb54e774b81b52c289c37e6f
Instruction Fuzzy Hash: 89814FB0A09A5CCFEB95EB68C455BACFBF1FF69300F5041A9D04EE7251CA349985CB41

Function 00007FFAAC163E47 Relevance: 2.7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

"rH, xrefs: 00007FFAAC163E90
6H, xrefs: 00007FFAAC163E48

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: 6H$"rH
API String ID: 0-1209893370
Opcode ID: 41af06c43efc9570b8b65e72f75a671aff90f3cf2cd4d852726fa39857560fe2
Instruction ID: 2c846ba6b2ad83cd7840933a52139e3522c0525d735c2cf8332a02dd14256ea1
Opcode Fuzzy Hash: 41af06c43efc9570b8b65e72f75a671aff90f3cf2cd4d852726fa39857560fe2
Instruction Fuzzy Hash: D7516EB0A09A5D8FEB95EB68C454BA9BBF1FF59300F4040EDD04EE7291CA349884CB41

Function 00007FFAAC166CB1 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

r6H, xrefs: 00007FFAAC166D42
r6H, xrefs: 00007FFAAC166CF7

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: r6H$r6H
API String ID: 0-3220753033
Opcode ID: 0ac693b780f52654a34773e683c8c737c7bbb6c94dee6cd41410b920da8ada0e
Instruction ID: 4123b004c2004882ff38f0802200f3fd45131c6eec3c1058d73d6a2270a96e97
Opcode Fuzzy Hash: 0ac693b780f52654a34773e683c8c737c7bbb6c94dee6cd41410b920da8ada0e
Instruction Fuzzy Hash: 86316AB5A09B4A8FF7429B68D4157E9FBE0FF96320F4441BBD00AC71D2EA38684587D1

Function 00007FFAAC160898 Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

K;P, xrefs: 00007FFAAC16096F

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: K;P
API String ID: 0-4840859
Opcode ID: 50a332f353ca3548b18bd05c42d3bf422469791ea8108a7ea7276aa652c62052
Instruction ID: 02b42c81ce3acf8401e66e296e857ae9d84c2387517e69486b5a6992437ce87c
Opcode Fuzzy Hash: 50a332f353ca3548b18bd05c42d3bf422469791ea8108a7ea7276aa652c62052
Instruction Fuzzy Hash: 49B13A75A0891C8FDB94EBACD885BEDB7B1FF59311F0041BAE14DD7252CA34A885CB90

Function 00007FFAAC1608A8 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

K;P, xrefs: 00007FFAAC16096F

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: K;P
API String ID: 0-4840859
Opcode ID: 0636f76bb1b559bb3b24ec7261b16958f61c059c9633ac0e8397d74049810446
Instruction ID: c2a6c22bcdbbf90314acdfcca8654820c90f9bb33b4cb7eaf48bf14fb6e74df6
Opcode Fuzzy Hash: 0636f76bb1b559bb3b24ec7261b16958f61c059c9633ac0e8397d74049810446
Instruction Fuzzy Hash: B9A12A75A0891C8FDB94EBACD885BEDB7B1FF59311F0045BAE14DD7252CA34A885CB80

Function 00007FFAAC1608B8 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

K;P, xrefs: 00007FFAAC16096F

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: K;P
API String ID: 0-4840859
Opcode ID: b9cfc0956cebe920a3b6a757b6d046e393d7d7aab53979d1b6690a0a1b730e06
Instruction ID: fb37cc906c2fedc818b24aa745194b252e82bded796153d8bcaef89e2e708fef
Opcode Fuzzy Hash: b9cfc0956cebe920a3b6a757b6d046e393d7d7aab53979d1b6690a0a1b730e06
Instruction Fuzzy Hash: 73A12975A0891C8FDB94EBACD885BEDB7B1FF59311F0045BAE14DD7252CA34A885CB80

Function 00007FFAAC1608C8 Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

K;P, xrefs: 00007FFAAC16096F

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: K;P
API String ID: 0-4840859
Opcode ID: 56d96d80eb15688d9454703a8ed9540ff22bee02e1e81c2d7d2cc8e5bad740cf
Instruction ID: 7b785277cfec0885b8e2515ef5f4c89ae01ceddc7eb725e22123ba6be7344f9a
Opcode Fuzzy Hash: 56d96d80eb15688d9454703a8ed9540ff22bee02e1e81c2d7d2cc8e5bad740cf
Instruction Fuzzy Hash: B7A12A71A0891D8FDB94EBACD885BEDB7B1FF59311F0041BAE00DD7252CA34A885CB80

Function 00007FFAAC160908 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

K;P, xrefs: 00007FFAAC16096F

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: K;P
API String ID: 0-4840859
Opcode ID: 2a83425f95d3aac296dcccec9788cb97266c948cc1edb4acff929382ba7158a9
Instruction ID: eeed78f0e51fb1b0a30c3a7253a5a3cd800fbd6191a53c41d0dc3a1b7ea877c9
Opcode Fuzzy Hash: 2a83425f95d3aac296dcccec9788cb97266c948cc1edb4acff929382ba7158a9
Instruction Fuzzy Hash: B3A11975A0891D8FDB94EBACD885BEDB7B1FF59311F0045BAE00DD7252CA34A885CB80

Function 00007FFAAC163E0C Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

"rH, xrefs: 00007FFAAC163E90

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID: "rH
API String ID: 0-1031174462
Opcode ID: 2ac08c90226aab7ab417f07e17939267b38c3890243a206b0c4d988ac0105fc8
Instruction ID: 7955d0b5c0cc805c2f5332dc462633bd76d2cd49c79472a31f493d26bfa6a3ff
Opcode Fuzzy Hash: 2ac08c90226aab7ab417f07e17939267b38c3890243a206b0c4d988ac0105fc8
Instruction Fuzzy Hash: AF916DB0A09A5CCFEB95EB68C494BACBBF1FF59300F5040EAD04EE7251CA349885CB41

Function 00007FFAAC168DEF Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68c8252bb372d640d4022afd95b44eedc994e9a5bf8d9f0bcb87bb7d4b5e525
Instruction ID: 9ee305182187f75a0214344d9abfb27a359c77c5fe6ce327e6894b3479847216
Opcode Fuzzy Hash: b68c8252bb372d640d4022afd95b44eedc994e9a5bf8d9f0bcb87bb7d4b5e525
Instruction Fuzzy Hash: C43108A290E7C28FF352633898162A4BBD0EF53711F0884B6D18D8B2D3DD2C995D87C2

Function 00007FFAAC1659E6 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9cf316f5966f187e76e51e0816f5f86ff700811a4bc3101ffd32c8d7f5f48b
Instruction ID: 0ceed1579347f3a8a992249421f852f58f3bcc65e5d7e8b0f22be59635510f4b
Opcode Fuzzy Hash: ab9cf316f5966f187e76e51e0816f5f86ff700811a4bc3101ffd32c8d7f5f48b
Instruction Fuzzy Hash: 5A81B774A08A5D8FDF94EF68C895BACBBF1FF69301F4441AAD00DE7251DA74A885CB40

Function 00007FFAAC1609A0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0371152c5dad832690ffc5c3a5a273d4f03fb12ffc3e7c718a3a34bebd252a9
Instruction ID: 221455df175395dc0fbe1ddde61e61c2f7778d4aa61ae2550dbf0312fc15c3ca
Opcode Fuzzy Hash: b0371152c5dad832690ffc5c3a5a273d4f03fb12ffc3e7c718a3a34bebd252a9
Instruction Fuzzy Hash: C3718674A08A1D8FDF94EF68C895BACB7F1FF69301F5041A9D00DE7251DA74A885CB40

Function 00007FFAAC16B605 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d367e5915ab6507c08640170de481c5c02851b3d3e1aee53501a413a62d8f428
Instruction ID: 1c76238c44434faac28e6eddcad2f4108d9de4780959ecfd4c235a68eefab87c
Opcode Fuzzy Hash: d367e5915ab6507c08640170de481c5c02851b3d3e1aee53501a413a62d8f428
Instruction Fuzzy Hash: D6815E71D0A61A8FEB5AEB14CC91AE9F7B4FF15300F0082B9D51D97291DB34AA49DB80

Function 00007FFAAC162282 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b863d630fb94e3e1d20cb5beebc45b8f604cc4782f6e57adf35d1e6cc95248
Instruction ID: 171c02459672d5862b89a9a3d9c0255bf0ee553b75e586153db44160d7eb69cf
Opcode Fuzzy Hash: 66b863d630fb94e3e1d20cb5beebc45b8f604cc4782f6e57adf35d1e6cc95248
Instruction Fuzzy Hash: 87716370909A4DDFEB85EBA8D455ADCBBF0FF5A311F0440A9D04DE7262DB789885CB40

Function 00007FFAAC165ED3 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4686d3c9addb739c828deaffa198416dc1ae3e6a97d48858733b65212cea91
Instruction ID: 584819546eeee96c290aeaa34401525c9a09f7321544bd4bf823d714f0f1f746
Opcode Fuzzy Hash: 1e4686d3c9addb739c828deaffa198416dc1ae3e6a97d48858733b65212cea91
Instruction Fuzzy Hash: FA51FA25ABF29BC5FA53733884AE4FAE650DF43388F81AC72E60C450D39D89A11C81D9

Function 00007FFAAC160B0D Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55634e13c63a01ccf38e67373b151dd44b85becace0ee36a83f6e64fb44014d
Instruction ID: dc18e95c3d58c5a214a66e60c80899b0b89e6eef3b12a73d6079abb0e2a0b2df
Opcode Fuzzy Hash: d55634e13c63a01ccf38e67373b151dd44b85becace0ee36a83f6e64fb44014d
Instruction Fuzzy Hash: 9A512C72A0A6898FF342EB7CD8555E8BBA0EF56314B0440BAD14DDB1D3DE28584BC794

Function 00007FFAAC160B30 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31536dbd05036bd4741c951317a720157220a34384349f47e08e4c0e047d8c47
Instruction ID: 4ade8f9a0bd87b8c3e6cbadfb014200050d99b5b1b7433d428a50ae27b06114d
Opcode Fuzzy Hash: 31536dbd05036bd4741c951317a720157220a34384349f47e08e4c0e047d8c47
Instruction Fuzzy Hash: B841FA72A0A689CFF782D778D8555E8BBA0EF56310F0480BAD14DDB1D3DE28584BC794

Function 00007FFAAC160B38 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ea1e86708dca0bdd8f7d80dba1872827651bf11c29bf652f1de3481dda14e3
Instruction ID: d675a3d02efd3b68136f397aca2260464847bbfb5bbc8941e6c8aec126a155aa
Opcode Fuzzy Hash: 54ea1e86708dca0bdd8f7d80dba1872827651bf11c29bf652f1de3481dda14e3
Instruction Fuzzy Hash: 09410C72A0A6898FF782D778D8595E8FBA0EF56310F0480B6D14DDB1D3DE18584BC790

Function 00007FFAAC160B40 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9492cbc1216aac321b69d26ddecbae829656d6d55e69bb71b01a6ca2d9ff93c
Instruction ID: 6fcd7d57c2d70e806abedd19086def5e715749746b1cd05944065cf4492b6b70
Opcode Fuzzy Hash: c9492cbc1216aac321b69d26ddecbae829656d6d55e69bb71b01a6ca2d9ff93c
Instruction Fuzzy Hash: F941FA72A0A6898FF782DB78D8591E8FBB0EF56310F0440B6D14DDB2D3DE28584AC790

Function 00007FFAAC160B48 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c69e1dd426f2a370f3ed498fbea73ba562939625217f23eaae0f4b02955add3
Instruction ID: 9b8019dbc472d27286b190e0ce4e6387d1736dbe255db7d4762d2f4fcbea6014
Opcode Fuzzy Hash: 9c69e1dd426f2a370f3ed498fbea73ba562939625217f23eaae0f4b02955add3
Instruction Fuzzy Hash: 6541C971A0A6898FF782DB68D8591E8FBB0EF56310F0440BAD14DDB2D3DE68584AC790

Function 00007FFAAC160B50 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840eac4084c3038fd92440c241080605d9bfa00d9d7877d683b6df911efc5de2
Instruction ID: afd357b5952e9759eb0464eb7f3aea8c7bd892eb8e8edeee31516d2855caac15
Opcode Fuzzy Hash: 840eac4084c3038fd92440c241080605d9bfa00d9d7877d683b6df911efc5de2
Instruction Fuzzy Hash: 8D41D671A0A68A8FF782DB68D8591E8FBA0EF56310F0440B6D14DDB2D3DE685C4AC790

Function 00007FFAAC160CE5 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f2df39701406a586dbd62630590e5725d977be81dafc7bfd0e934f34eed340
Instruction ID: 702b7fef1f5cd7ac5043d3695a7ee6bbbe0377b60b40c971c5d76df7c16659b4
Opcode Fuzzy Hash: 51f2df39701406a586dbd62630590e5725d977be81dafc7bfd0e934f34eed340
Instruction Fuzzy Hash: 2B41D6B290AB869FF3828BB894595EABFF0DF5627070840FAC049DB1A7E56C5C43C710

Function 00007FFAAC166DE5 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14d1a19fba9138a4a08b0ee6dc37a05bbdd6563d07af1c8caf8aa56a5cfc5de
Instruction ID: ee628d2b10b9e2d4659b7e9a138180e72ce198038cd0c2e46131b192df9c7e3e
Opcode Fuzzy Hash: f14d1a19fba9138a4a08b0ee6dc37a05bbdd6563d07af1c8caf8aa56a5cfc5de
Instruction Fuzzy Hash: 42417E71D0975D8FEB51DBA8C805AADBBB1FF46300F4041BAE04DD7192DB385988CB91

Function 00007FFAAC167E2A Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc39d9151a529f02afe055beddae3055155d3932d9b204c85c76358d31a13f9
Instruction ID: e294906a7e9b6aaa6caee6df636c13259e83aca1d17cc479a9cd940b182bf8b5
Opcode Fuzzy Hash: efc39d9151a529f02afe055beddae3055155d3932d9b204c85c76358d31a13f9
Instruction Fuzzy Hash: 8B417C30D0A249CFD75ADB64C854AE9BBF1EF07310F0581EAD05AD7292DB389A89CB41

Function 00007FFAAC1668B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a38aea17d16a57697e0ebcc74881c7cdf551fa31f37d4ed364bbd14a14534d
Instruction ID: eb266e29a1bed515d8b11f8b946e8c92e5215689678bdf0c05860ce620be8e5e
Opcode Fuzzy Hash: e4a38aea17d16a57697e0ebcc74881c7cdf551fa31f37d4ed364bbd14a14534d
Instruction Fuzzy Hash: 5E215E6488F3C68FE3034B708C256E67FF49F47111B0A41E7D489CB0A3DA6D995AC7A2

Function 00007FFAAC1610F4 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86bf5b736b5121ea3c3a085e201d12d7231a5f59801d2ad392d92827aeeea246
Instruction ID: 173787a825be0004129c7649c7e1e04f5155bcb9bd9ee3bff039ca17d2ed3045
Opcode Fuzzy Hash: 86bf5b736b5121ea3c3a085e201d12d7231a5f59801d2ad392d92827aeeea246
Instruction Fuzzy Hash: 2C31E6B0905A5D9FDBA1EB68881DBDABBF1EF59311F5840EAC14DD7221DA385E81CF00

Function 00007FFAAC1621B9 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dee2b997b9e11fad027a1a103770d1a22477a2bb153e3af00ea05d2f2dd30b3
Instruction ID: c6503ab19127608e0dc0bcd3c5bf3fe1f8d94fef32997bfb0fbc88c458f6e255
Opcode Fuzzy Hash: 8dee2b997b9e11fad027a1a103770d1a22477a2bb153e3af00ea05d2f2dd30b3
Instruction Fuzzy Hash: 36214FB1D09A4D9FEB41EBA8C855AEDBBF0FF59311F04016AD509E72A1DB38A845CB40

Function 00007FFAAC16B7C4 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5101b47646d122bcd211df7039fe0298c528f72aabb2876083420e696230fd
Instruction ID: 3957c259d397bdbf237f655bb4d536dadda05a29a76d3bdba25f16bc4152de5c
Opcode Fuzzy Hash: 1a5101b47646d122bcd211df7039fe0298c528f72aabb2876083420e696230fd
Instruction Fuzzy Hash: 8E210270D1961A8FEB56DF54C880BEDB7B0FF44304F1081A8D01DA3294CB38AA8ADF80

Function 00007FFAAC16A572 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54be2b9bada8cbb99d11488eda797569751d99b8108f565a33f5717ceb4c1041
Instruction ID: 6b89068bcaa0c3ff6b1a3ecdc4939891b6af35951902ae69d196b57a12698383
Opcode Fuzzy Hash: 54be2b9bada8cbb99d11488eda797569751d99b8108f565a33f5717ceb4c1041
Instruction Fuzzy Hash: 8311E671D0891DCFDB94DF68C4556E8FBB1EF59310F4490AAD00DE7292DA34A9899F40

Function 00007FFAAC16723C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6af24e4ee1d1ab1a00452be33127afc86488aeccd6dd1852af87cc719cad53
Instruction ID: 609b20cd5c31706b1315102ef6afb8251020407069e152d74cf43b1999cd023b
Opcode Fuzzy Hash: 8f6af24e4ee1d1ab1a00452be33127afc86488aeccd6dd1852af87cc719cad53
Instruction Fuzzy Hash: C921A1B0E0E2898FE756DB74C8556D9BFF1AF46320F0404FED049972A2DA786884CB40

Function 00007FFAAC169566 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba56c459838651b1e0c032f69cdd107c0338615c84d24866ea61f4818ff01719
Instruction ID: 03a5e180a4698ee7d0d6ddc4d52e657f046ac5a68171f5942e733b8479655590
Opcode Fuzzy Hash: ba56c459838651b1e0c032f69cdd107c0338615c84d24866ea61f4818ff01719
Instruction Fuzzy Hash: 2111AD7084E7C98FE343577088296D5BFF1AF87320F0940EAD489CB0A3D92C594ACB62

Function 00007FFAAC166591 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ee316a6e63406babc09e28c489e09a88ace706d614e6cf68f69df240ccc66a
Instruction ID: 818629cae3e2fa36e2bc61ae7a36f61853df8fc2b1802cb2ae98d239066a20df
Opcode Fuzzy Hash: 50ee316a6e63406babc09e28c489e09a88ace706d614e6cf68f69df240ccc66a
Instruction Fuzzy Hash: 12F09A71C4A64DCBFB129B20881A2FDBFA0EF1A301F4045A6D50C96092EA7895288281

Function 00007FFAAC16B7A5 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0786c79e7d8640b1b1391bb0727dd74591968892676ef0e46907b0a6c9faa3
Instruction ID: f502a04cf0c0a38cd6210d6e3e4b76327bcbf60b2598b2cdd24f40f10bf1e31e
Opcode Fuzzy Hash: 9a0786c79e7d8640b1b1391bb0727dd74591968892676ef0e46907b0a6c9faa3
Instruction Fuzzy Hash: 81011B70D1561A8BEB96DF58C880BE9B7B4FF45304F1081A9D51DA3290CB34AA49DB80

Function 00007FFAAC16B7B1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56acc21bd962afaeaec0c2bb7b038c99beb5c83edd9f76d0601d7e110a9ec052
Instruction ID: b3ccae204e9363e6faa23972857e22ffe3203bef43f3134a6ae27e837bd3cc0a
Opcode Fuzzy Hash: 56acc21bd962afaeaec0c2bb7b038c99beb5c83edd9f76d0601d7e110a9ec052
Instruction Fuzzy Hash: E5011A70D156198FEB9ADF08C884AEDB7B4FF49304F1081A9D50DA3290CB34AA49DB80

Function 00007FFAAC167F81 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b43e751758982f0518ac6e6390e1d36132fd1cd60166457c77ac9a758259a4
Instruction ID: b58be39a507d4117154599c61dcd706fa597efc704740eda4ad645385c0b71e8
Opcode Fuzzy Hash: 67b43e751758982f0518ac6e6390e1d36132fd1cd60166457c77ac9a758259a4
Instruction Fuzzy Hash: 4201817080A6599FEB91DB6484447DAB7F0EF56301F1480E9C04CE7151C7788EC5CB40

Function 00007FFAAC16B7BB Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d703fd73ab795e30de712aaaa652c04194c305ed10c2263262669c6f05b60a
Instruction ID: 87af2011b32b3019bbf99f7a40a91060c5d62f9fd8b6680ebd6a2bd055730cfb
Opcode Fuzzy Hash: f2d703fd73ab795e30de712aaaa652c04194c305ed10c2263262669c6f05b60a
Instruction Fuzzy Hash: 38F03C70D1960A8FEB9ADF54C881BE9B3B4FF05304F1041ACD51DA3290CA34A95ADB90

Function 00007FFAAC167CE1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b744abbe9240c41cd61207299c3ea63f36103d77553f2b3dce4ccff3e39315c7
Instruction ID: 0624ce0cef37184395bc7c25d48b87c084c002896f8482c1dc7b8aed83673c58
Opcode Fuzzy Hash: b744abbe9240c41cd61207299c3ea63f36103d77553f2b3dce4ccff3e39315c7
Instruction Fuzzy Hash: F7F0F830D09A5CCFDF90DB68D844AACB7B0FF45310F0042AAD44ED7152DA31A995DB94

Function 00007FFAAC16122F Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c344654ab3486dedd6d0e758e8d7c1aeb2d231bf88e1ab0cdabe333bd62e54fb
Instruction ID: c6f6ce280d8121444ed710e0a92a403e41f15d72f7cc149cb320a22c330fe7db
Opcode Fuzzy Hash: c344654ab3486dedd6d0e758e8d7c1aeb2d231bf88e1ab0cdabe333bd62e54fb
Instruction Fuzzy Hash: 00F07F70A0AA599FEB91EB24C859ADABBF1EF59311F1440D98089D7251DB749D81CB00

Function 00007FFAAC160F50 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00fbfb86f4788221ef0e3fac760abd48d9eb390a6f3a45b1af3adc1b9f9c850
Instruction ID: a62a09e1358e1c95a6e07fbf73da35f9052347e1ae9eb85ad1ecdbd58595e55d
Opcode Fuzzy Hash: f00fbfb86f4788221ef0e3fac760abd48d9eb390a6f3a45b1af3adc1b9f9c850
Instruction Fuzzy Hash: 10F09270905A6D8FEF90EF68C859B99BBB1EF59210F1441DAC00DE7251DA3499858F10

Function 00007FFAAC160FB9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0193f90a8b9ffa0e52c161fbbe944b7a9be2b87b83fb2985820133e05ddb647
Instruction ID: f32c2ee4802daaf9a5daaf95a9ca97d685719fddb1df9fbb0f79a83b2cee3a9b
Opcode Fuzzy Hash: b0193f90a8b9ffa0e52c161fbbe944b7a9be2b87b83fb2985820133e05ddb647
Instruction Fuzzy Hash: 41F0F87090495A8FDF90EB24C458BE9B7B1EF19200F0480E9800EE3211DA3459C59F00

Function 00007FFAAC161022 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea0580671f1ac7e84b18450c3161cada9e985ec9a98898f89392e4a2aa835cd
Instruction ID: 47630728dd9c071a3f29ebf65eb737dc614c2d28af8e4f7ffdcfe5e00986683a
Opcode Fuzzy Hash: 8ea0580671f1ac7e84b18450c3161cada9e985ec9a98898f89392e4a2aa835cd
Instruction Fuzzy Hash: F0F0A570908A1D8FDF95EB64C8596D9BBF1EF69311F1440E9C14DD3251DAB49EC18F40

Function 00007FFAAC16108B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd73adfd9956cf84477f6a6fee2a198ee4b2218faccb92d9806c3a915c991b3a
Instruction ID: 3119c91e5d1c175e47def04328110fd2770afbd78594e96eaa134d7602b5e80c
Opcode Fuzzy Hash: fd73adfd9956cf84477f6a6fee2a198ee4b2218faccb92d9806c3a915c991b3a
Instruction Fuzzy Hash: ACF0A570915A198FDF91EB64C8696D9BBF1EF59311F1441E9C04DD3261DA349E91CF00

Function 00007FFAAC1672D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308e4d7a390aa63b9a28e7d5fb2f779f91a998e66f0f5be6ed8d3fa831638c2d
Instruction ID: 76e6b3e212f5afa6a72be9480b6b48f832b06468cc0dd33336a4a82a5f9a5abc
Opcode Fuzzy Hash: 308e4d7a390aa63b9a28e7d5fb2f779f91a998e66f0f5be6ed8d3fa831638c2d
Instruction Fuzzy Hash: 63F030B0E196998FE756DB64C8656D9BBF1AF45310F0440EEC405D7261CB785985CB40

Function 00007FFAAC160EF4 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f7be4108071b0cec6c027055606b7dbb1d2e5452f26517581e466cd8e788fc
Instruction ID: a52e203f463e7a653a74a930ff6c42073db700eb25a60d63d66e2d1b7e417bca
Opcode Fuzzy Hash: f9f7be4108071b0cec6c027055606b7dbb1d2e5452f26517581e466cd8e788fc
Instruction Fuzzy Hash: 07E0E570A09B589FEF90EB28C45CB9ABBF2EF1A210F0440DA804DD7261DB349985CF01

Function 00007FFAAC16134D Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4001368892.00007FFAAC160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac160000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376ae85e5b648dbe651ce9898498b3a8d8cde32c2c5352a2137ce08a7936d7b3
Instruction ID: e52dede03afa8116b3acdcef72ffa293eee87875fec39611d9de015c1c266d28
Opcode Fuzzy Hash: 376ae85e5b648dbe651ce9898498b3a8d8cde32c2c5352a2137ce08a7936d7b3
Instruction Fuzzy Hash: E8C012B0545A1A8FE782DB248C186A5B6E1AF4A210B4400FA880DC7196DA284C8D4740

Analysis Process: ApplicationUrl.exePID: 2008, Parent PID: 4432COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	63.6%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFAAC355669 Relevance: 8.4, Strings: 6, Instructions: 858
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0WR, xrefs: 00007FFAAC355D29
b4H, xrefs: 00007FFAAC3557D5
0WR, xrefs: 00007FFAAC355DBE
b4H, xrefs: 00007FFAAC355971
6H, xrefs: 00007FFAAC355E6A
0WR, xrefs: 00007FFAAC355D62

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: 6H$0WR$0WR$0WR$b4H$b4H
API String ID: 0-1426279900
Opcode ID: b77274ea6d7ae5df083aa5812a9476a1d3d43e013a79c0dabd3b3d0338e0bd9e
Instruction ID: bf39cc3d0a3dd4e9497830a590bccdac65269dc45f869449d1f6b449233cd1cb
Opcode Fuzzy Hash: b77274ea6d7ae5df083aa5812a9476a1d3d43e013a79c0dabd3b3d0338e0bd9e
Instruction Fuzzy Hash: FD42F231A1AF4A8FEBA8DB288459A75B7E1FF56300F04427DD44EC3682DE25F84587C1

Function 00007FFAAC1E6520 Relevance: 6.1, Strings: 3, Instructions: 2310COMMON

Download Yara Rule

Strings

0#R, xrefs: 00007FFAAC1E9FFF
0XR, xrefs: 00007FFAAC1E9D32
xL_H, xrefs: 00007FFAAC1E99EF

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: 0#R$0XR$xL_H
API String ID: 0-79380265
Opcode ID: 4d982347827e2a4704086a4af96150e2376808d8dd1504cf0f99402c5770db27
Instruction ID: 483505f0753cbfa530943cfa24b7a0fdeae879fe2576282865fe6bf98ef8eb5e
Opcode Fuzzy Hash: 4d982347827e2a4704086a4af96150e2376808d8dd1504cf0f99402c5770db27
Instruction Fuzzy Hash: 13038470A19A498FEB99DF18C494BB97BF1FF5A300F1481A9D04DD7292DB34E885CB81

Function 00007FFAAC36DEF2 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 574
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

), xrefs: 00007FFAAC36E124

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC35A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC35A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac35a000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 62c4251d01a89585bd509de77e2dca1e17d48b992b1623bd6bd03653c3e8e10f
Instruction ID: 8a83f9823ac200d3636788f7216c986374bf72865e5d5abefc31f8204fd5ccca
Opcode Fuzzy Hash: 62c4251d01a89585bd509de77e2dca1e17d48b992b1623bd6bd03653c3e8e10f
Instruction Fuzzy Hash: FE02F67190DB8ACFEB55DB58C855AEAFBB0EF57310F0481BBD04CDB192CA34A8498791

Function 00007FFAAC3523E4 Relevance: 2.0, Strings: 1, Instructions: 714
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`%R, xrefs: 00007FFAAC3525A9

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: `%R
API String ID: 0-3585420134
Opcode ID: 3b636eff574229af19b039c41b245cd8ef49147f421baf3db6ac387f79485d8b
Instruction ID: 3a61d62682ad825ee2bd80287f7b32417fe712923c6fe74f538c31d51debed39
Opcode Fuzzy Hash: 3b636eff574229af19b039c41b245cd8ef49147f421baf3db6ac387f79485d8b
Instruction Fuzzy Hash: 19227F307199498FEB98EB2CC459E78B7E1FF5A300F1580B9E44EC72A2DE25EC458791

Function 00007FFAAC1A1749 Relevance: 1.8, Strings: 1, Instructions: 534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r6H, xrefs: 00007FFAAC1A18A1

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: r6H
API String ID: 0-2179486592
Opcode ID: ecfeba155461e306198edd460997cfbe1d917a58128397bba89ea3853706e71c
Instruction ID: f124f6a01bb421499d6f5ef5e11c8a4ac146bf79bb42f92df65303b01ce1454a
Opcode Fuzzy Hash: ecfeba155461e306198edd460997cfbe1d917a58128397bba89ea3853706e71c
Instruction Fuzzy Hash: FE32E170E08629CFDB68DF68C895AACB7B1FF59304F1481A9D01EE7252CA34A985CF54

Function 00007FFAAC351979 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c34db4b58df768d42a24505b30bb6fcad605a553ab1eaa6e3ec529d05c428af3
Instruction ID: 7cabfd61bccbf910303ce3d578daf1bac8e6f4a1f24a9444d9ddcbc9f810af35
Opcode Fuzzy Hash: c34db4b58df768d42a24505b30bb6fcad605a553ab1eaa6e3ec529d05c428af3
Instruction Fuzzy Hash: FD32A230A09A498FFB99DB1C8455B79B7E1FF5A300F1481BED44EC7292CE25E84A87D1

Function 00007FFAAC352DB5 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ae2689b693b9b6bfcce9d406365aa560f37787e757f6a5fb742cea62ec63dc
Instruction ID: dc53142023a9af395cdc184feb6dd495d8d33ecf2d722ff2314164455d9655b0
Opcode Fuzzy Hash: a3ae2689b693b9b6bfcce9d406365aa560f37787e757f6a5fb742cea62ec63dc
Instruction Fuzzy Hash: 71024722B0DE4A8FF799972C9459AB5B7D1EF96310F0481BED04EC3292DD19EC0683D1

Function 00007FFAAC355F78 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825fe4ffa5728c3fee736d8a32146f62f8106c5903fc46e703b37fdcafdc65dd
Instruction ID: 3e33a62f23552fdcc86bea46fc57ae2b2a8389c5172af970788d27ee1a96ac13
Opcode Fuzzy Hash: 825fe4ffa5728c3fee736d8a32146f62f8106c5903fc46e703b37fdcafdc65dd
Instruction Fuzzy Hash: 2EB11B65A0EA8D4FE755E77CC8599E9BFE0DF57310B0881BED04DCB2A3CD18A8098391

Function 00007FFAAC355088 Relevance: 4.5, Strings: 3, Instructions: 778
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0WR, xrefs: 00007FFAAC356948
0WR, xrefs: 00007FFAAC3569D4
(LR, xrefs: 00007FFAAC35699B

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: (LR$0WR$0WR
API String ID: 0-1532310460
Opcode ID: e8889bd2471cf5051c1b2289921a79fe4a8e232220b0a00347451b569739e318
Instruction ID: fa4cf1f8187b6cdefc0e638a9d55ca7d6fb2078e74bd768691acd46add046e64
Opcode Fuzzy Hash: e8889bd2471cf5051c1b2289921a79fe4a8e232220b0a00347451b569739e318
Instruction Fuzzy Hash: BC321660A1DE0A8FF7599B2D8449A75B7E1FF96300F0485BDD48FC3296DE24E80687D1

Function 00007FFAAC354B81 Relevance: 3.0, Strings: 2, Instructions: 510
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FFAAC354E59
b4H, xrefs: 00007FFAAC354F2A

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: b4H$d
API String ID: 0-1243160078
Opcode ID: c1d5fe52e7cda2199491d976b344f105b25fd8d0c779aa500ba13091cc1d4ee0
Instruction ID: 0a8a82b6bef8fc09caa5f199f39b1696409dda344b231e864b2b947157bc6a4c
Opcode Fuzzy Hash: c1d5fe52e7cda2199491d976b344f105b25fd8d0c779aa500ba13091cc1d4ee0
Instruction Fuzzy Hash: 95F1DE31A18A498FE74DDF28C489975B7E1EF96300B1486BDD44ECB297CE35E846CB81

Function 00007FFAAC352320 Relevance: 2.8, Strings: 2, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}J, xrefs: 00007FFAAC3523A2
(LR, xrefs: 00007FFAAC352647

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: }J$(LR
API String ID: 0-1305449584
Opcode ID: 4736cdb3b484d2819733bd110ca5f3ace733ecb121ce101f6362ada1cdc2c5db
Instruction ID: 2f9a5778c7077cb4ac512d187538c4b495e73c915758634e1fe98536692ae738
Opcode Fuzzy Hash: 4736cdb3b484d2819733bd110ca5f3ace733ecb121ce101f6362ada1cdc2c5db
Instruction Fuzzy Hash: CD815C70A18D1D8FEB98EB1C8459B74B7D1FFA9311F0480BAE44DC72A6CE25EC458791

Function 00007FFAAC1E6750 Relevance: 2.7, Strings: 2, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0WR, xrefs: 00007FFAAC1E690A
r6H, xrefs: 00007FFAAC1E67F5

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: 0WR$r6H
API String ID: 0-2423489197
Opcode ID: e9e37c33bf75ba5067dfa560d8b7b1fb9b5e69d422a5772f7f0c6e5952bfba5c
Instruction ID: 00bffe7fe14b6edf37e52fcaedac4a6036500b8a21b52ad8a1bcbff9fe253bbf
Opcode Fuzzy Hash: e9e37c33bf75ba5067dfa560d8b7b1fb9b5e69d422a5772f7f0c6e5952bfba5c
Instruction Fuzzy Hash: 6F610871A1DB8A8FE766973C44616B57BE0EF57314B8841BEE04EC7293DE18E80983C1

Function 00007FFAAC18C798 Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"9H, xrefs: 00007FFAAC18C84C
r6H, xrefs: 00007FFAAC18C945

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC18C000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC18C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac18c000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: "9H$r6H
API String ID: 0-344627539
Opcode ID: d3dc471eca82713b33adb090908d259cd061d85dd87fbc8ceb44d8e0e30801a6
Instruction ID: a42a0f17062429f3adc4976aa8cdaa4f6a60a69822221ec75b496fc4af41038b
Opcode Fuzzy Hash: d3dc471eca82713b33adb090908d259cd061d85dd87fbc8ceb44d8e0e30801a6
Instruction Fuzzy Hash: 5551A46190DB898FE747DB68D8646A9BFF0EF57300F0841FBD049DB2A3DA285849C761

Function 00007FFAAC1E6460 Relevance: 2.6, Strings: 1, Instructions: 1303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0WR, xrefs: 00007FFAAC1EB416

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: 0WR
API String ID: 0-1238210810
Opcode ID: 71ed5b94496eb47f51c09542f547505235cf32ece0a4ca51398a1e62d50f25a2
Instruction ID: 3001754ec9ae16a0d2fbd506fca14fd420b81ecff98de2e9f4161a4eb75ede1d
Opcode Fuzzy Hash: 71ed5b94496eb47f51c09542f547505235cf32ece0a4ca51398a1e62d50f25a2
Instruction Fuzzy Hash: 2881F571B19E4A8FF7A9E72C945567963D2EF9A350B4481B9D00EC72D6DE28EC0683C0

Function 00007FFAAC197C4A Relevance: 2.5, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a, xrefs: 00007FFAAC197CAB
D, xrefs: 00007FFAAC197C7B

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC197000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC197000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac197000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: D$a
API String ID: 0-1133464678
Opcode ID: ad53a3924092b11b77a2f6ceaf73caf3175022452e33c546bd13935a15a15aa4
Instruction ID: 2a3450878c1e28d0b608d26d6deca8b24f661849ac1c8fcb7e771ee89323d478
Opcode Fuzzy Hash: ad53a3924092b11b77a2f6ceaf73caf3175022452e33c546bd13935a15a15aa4
Instruction Fuzzy Hash: F811A270E19A29CEEB65EB24CC993A9B6B0EF55305F0045E9D10DA6281CB786B84CF85

Function 00007FFAAC1E9B84 Relevance: 1.8, Strings: 1, Instructions: 523COMMON

Download Yara Rule

Strings

0XR, xrefs: 00007FFAAC1E9D32

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: 0XR
API String ID: 0-1116856263
Opcode ID: eb04f8577def767b903bbbce36c69d9b1030bfce5e7a8d6798e0a6f45f2278f8
Instruction ID: 6bff7fa5b2d0144c8621584484b0a747cec1e42a93f7a5365f9430192b31f0eb
Opcode Fuzzy Hash: eb04f8577def767b903bbbce36c69d9b1030bfce5e7a8d6798e0a6f45f2278f8
Instruction Fuzzy Hash: E8025F30A18A19CFEB99DB18C4947B977E1FF59305F1081B9D04EE7291DB35EC868B80

Function 00007FFAAC2B3ABD Relevance: 1.7, Strings: 1, Instructions: 496COMMON

Download Yara Rule

Strings

:_H, xrefs: 00007FFAAC2B3FEF

Memory Dump Source

Source File: 00000004.00000002.1691791710.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac2b0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: :_H
API String ID: 0-1200089353
Opcode ID: 856fd9f6682e5558c04ef58d4f443b5294bb404825bde71a30e404424868d736
Instruction ID: 9639a7e76ad4dafe60ccb757a78501456ff13a98aaa71881bd7f88c93ad799f8
Opcode Fuzzy Hash: 856fd9f6682e5558c04ef58d4f443b5294bb404825bde71a30e404424868d736
Instruction Fuzzy Hash: 5C020A30D1A61ACFEBA5EB6884557BCB7B1FF5A301F504179D00D93296CF39A989CB80

Function 00007FFAAC19B81E Relevance: 1.7, APIs: 1, Instructions: 191memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFAAC19B95A

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19b000_ApplicationUrl.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d2b6018e918e1c509c23e83a0a7c899a045e75d672b82a7b2ec8f2056afa7eb9
Instruction ID: 5ce4412fdc01f92a236dc10153b37eb7a877479e443d466a5d67b1e9dd38ede8
Opcode Fuzzy Hash: d2b6018e918e1c509c23e83a0a7c899a045e75d672b82a7b2ec8f2056afa7eb9
Instruction Fuzzy Hash: 7B516D70D0864D8FDB55DFA8C885AE9BBF1FB5A310F10826AD449E3251DB74A885CB81

Function 00007FFAAC351AF0 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

8hJ, xrefs: 00007FFAAC351BA7

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: 8hJ
API String ID: 0-559254241
Opcode ID: 7ebd7b327f0ee97f41b87534149036af317bd798aa8f42823183d962960bef39
Instruction ID: c7f721f469819a40d3f2ad25cad2b183b9f0836667558951ce3d4e5246231d22
Opcode Fuzzy Hash: 7ebd7b327f0ee97f41b87534149036af317bd798aa8f42823183d962960bef39
Instruction Fuzzy Hash: 37D1C520A0AA4A8FF7599B2C8454BB9B7D1FF56304F1481BDD54FC72D3DE28E84A8790

Function 00007FFAAC1E58C0 Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

p]R, xrefs: 00007FFAAC1E59B7

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: p]R
API String ID: 0-3746448657
Opcode ID: fca232c07c549132d1b963b348fcd08f7afc126077bdedf90605e75f4cc0a7f4
Instruction ID: 41f6a150f402a61dfd2a03fdf1c69fd2814dfa5039484a3aced83790f6b14689
Opcode Fuzzy Hash: fca232c07c549132d1b963b348fcd08f7afc126077bdedf90605e75f4cc0a7f4
Instruction Fuzzy Hash: 32C13C71B0D6898FFB56E72C88555B47BE2EF96315F0841BAD04DCB292DE18DC0A83D1

Function 00007FFAAC1A20A3 Relevance: 1.6, Strings: 1, Instructions: 375COMMON

Download Yara Rule

Strings

p]R, xrefs: 00007FFAAC1A228F

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: p]R
API String ID: 0-3746448657
Opcode ID: 296daefc0417ea275efc8c355c6254dd0c70b77c3bd5f1f7971f8c086a1077ef
Instruction ID: 9eba5badb1c8bc5d3114a339e7cc8ec566fee49277e472eb92a21a6e97f7002d
Opcode Fuzzy Hash: 296daefc0417ea275efc8c355c6254dd0c70b77c3bd5f1f7971f8c086a1077ef
Instruction Fuzzy Hash: D8E1EF70A09619CFEBA9DB18C855BA8B7F1FF59700F1441E9D44DD72A1CA34AE85CF40

Function 00007FFAAC355FD0 Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

p]R, xrefs: 00007FFAAC3572D5

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: p]R
API String ID: 0-3746448657
Opcode ID: 2bc882fc460aaac1cbb002f39d6bfc6d4c7e0be4beb1f67c9ac1920a68c8a284
Instruction ID: e5bfe501c2abd2402b3c46494af4f55940c840cf0e49dfb648b75c6d004da12d
Opcode Fuzzy Hash: 2bc882fc460aaac1cbb002f39d6bfc6d4c7e0be4beb1f67c9ac1920a68c8a284
Instruction Fuzzy Hash: 68911A51A2DF4A8FF359972C941AAB5B7D1EF97310F1481BEE04EC3293DC18A84643D2

Function 00007FFAAC19D205 Relevance: 1.4, APIs: 1, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FFAAC19D31F

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19b000_ApplicationUrl.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 894d940d108849419e59771edd474191d97f59d4329f5fda8de8b9f415f15d7d
Instruction ID: 67e9f0540a209b2ba58e8ed0ebe303a44bafa4a84f94f59399a741f1e9474db5
Opcode Fuzzy Hash: 894d940d108849419e59771edd474191d97f59d4329f5fda8de8b9f415f15d7d
Instruction Fuzzy Hash: 93512E7090865C8FDF94EF68C845BE9BBF1FB6A310F1081AAD04DE3251DB7499858B80

Function 00007FFAAC182EA1 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

r6H, xrefs: 00007FFAAC182FC4

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: r6H
API String ID: 0-2179486592
Opcode ID: 7501c7750b19ee7673da99a91a31faae59a16be4993bb2e7b896e8021d6fe0b1
Instruction ID: 8bcd2bc93396c3e2500298dd9a48d26b3be77a23b6ecdc906390fa22ddaaab33
Opcode Fuzzy Hash: 7501c7750b19ee7673da99a91a31faae59a16be4993bb2e7b896e8021d6fe0b1
Instruction Fuzzy Hash: F441DE6048F7C25FD7838BB888645917FF19E5722470E81DBC4C4CF5A3E64E984AC722

Function 00007FFAAC18C5F3 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

~M_^, xrefs: 00007FFAAC18C601

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC18C000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC18C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac18c000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: ~M_^
API String ID: 0-1662397256
Opcode ID: 6b4a2c0f8a853c32dd043fedc24580591234af1e48207650d797f742164ae1b8
Instruction ID: ea58787d10bc40af492ae6fed25e985485688af4af4de1c2ed98fb5c9827908e
Opcode Fuzzy Hash: 6b4a2c0f8a853c32dd043fedc24580591234af1e48207650d797f742164ae1b8
Instruction Fuzzy Hash: B641D871E0E686CFF7039764C8656B9BBA0FF53310F0481B6D0098B296CE38965AC7D1

Function 00007FFAAC18304F Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

8[R, xrefs: 00007FFAAC183050

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: 8[R
API String ID: 0-2237876593
Opcode ID: a1a30beed2561dbfe7b423621b25d6d79aa01889799b80ef3e11e6e3a68cf4a7
Instruction ID: e38dfd0f723a22fd1af5143f8c9a19972d72296d1f71518824ee2945ae4a563d
Opcode Fuzzy Hash: a1a30beed2561dbfe7b423621b25d6d79aa01889799b80ef3e11e6e3a68cf4a7
Instruction Fuzzy Hash: 9111C122B0DA498FE796EA1C8418A747BE1DF57350B0902E3D40DDB2A2DD14DD4683C1

Function 00007FFAAC1E0868 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

r6H, xrefs: 00007FFAAC1E0869

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: r6H
API String ID: 0-2179486592
Opcode ID: f8af4c5cf15958c3ba3c1291d5d6f7a89d3780d43c5503b238520560f84db12e
Instruction ID: 0f5d59726ac0f49148b0669df016558ab28850a50c6f2f44fed3609e0ba59ff0
Opcode Fuzzy Hash: f8af4c5cf15958c3ba3c1291d5d6f7a89d3780d43c5503b238520560f84db12e
Instruction Fuzzy Hash: B8018C70E09609CFEB0ACB48C465ABDB7B0EB5A710F04827EC00AE6291CF386446CB81

Function 00007FFAAC357DD0 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b09f3d3a024b77b855edcb956f1fc2ff6129b535703633c714d1d1dd5f4b906
Instruction ID: 03c2e3e4b562b67f4f33e3b8f943d86df2511212501504304325d30ef492318e
Opcode Fuzzy Hash: 9b09f3d3a024b77b855edcb956f1fc2ff6129b535703633c714d1d1dd5f4b906
Instruction Fuzzy Hash: 9522C97191EA8DCFEB54DB18C84A9A9B7E1EF56300F1444BDD44DC7292DA24E80AC7D1

Function 00007FFAAC2B307C Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1691791710.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac2b0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1adc2b1c6626f86cf0f442b683d2d50ec70fc7d0ae5de5ea72a85fdaa3c4850
Instruction ID: 0f024a6e516eb021c3c7adca48dee2a1a75c1739cb9c8e51338e72ba998ab2b1
Opcode Fuzzy Hash: d1adc2b1c6626f86cf0f442b683d2d50ec70fc7d0ae5de5ea72a85fdaa3c4850
Instruction Fuzzy Hash: A3123D75A19A1ADFFFA4EB5C84857B977A1FF59300F504175C00DE3286DF38A8898B90

Function 00007FFAAC357CD0 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cd804549d604146ac277de8925ebd39ca1763a299371595de9c449569387b4
Instruction ID: 6988bb18c3261270ce8078170decd3247ccc0428f49066ba96c01081e704cf13
Opcode Fuzzy Hash: c1cd804549d604146ac277de8925ebd39ca1763a299371595de9c449569387b4
Instruction Fuzzy Hash: 24027F70619A4DCFEB98EF28C459AA9B7E1FF5A300F1040ADE44DC7296CA25E846C7D1

Function 00007FFAAC357F00 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697647d083b2a166d144398f872a826fc2f291079c12e6ce6026b4b1a3b7390e
Instruction ID: 2cbd9122969eb25fe8e08ac29715b7dd09972e80eda4dca2c70053cbb8256da4
Opcode Fuzzy Hash: 697647d083b2a166d144398f872a826fc2f291079c12e6ce6026b4b1a3b7390e
Instruction Fuzzy Hash: 61F1923091EA4DCFEB94DF18C859AA9BBE1EF5A300F1441BDD44DC7292CA64E84AC7D1

Function 00007FFAAC1E6EF5 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4394f504cff263f56f099acfc7b6c7e0d088184baa499adb2a2ce019454bab
Instruction ID: 0b4bae233dd9a455eb23c2e78aae6e7c87ed54782368a8ebd9345813fcf6255d
Opcode Fuzzy Hash: 9a4394f504cff263f56f099acfc7b6c7e0d088184baa499adb2a2ce019454bab
Instruction Fuzzy Hash: 73B1483161EB89CFF35B9B2898555B17BE0EF47320B1442BEE08DC7193DA19E84A83C1

Function 00007FFAAC351B44 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33465b0f3d9d0044e0eebde5f342832a716516d9d631e996e33ae5895b77857d
Instruction ID: d82d43d54a0931f7fc56b8f894b9f67784f24aaa1ff7062ba943898c9763dede
Opcode Fuzzy Hash: 33465b0f3d9d0044e0eebde5f342832a716516d9d631e996e33ae5895b77857d
Instruction Fuzzy Hash: CBB1D720A09A4A8FF7599B2C8454B79B7D1FF5A304F5481BDD58FC72D3CE28E84A8390

Function 00007FFAAC1E7840 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b5f139f5911686aab457dd77e75ca6ecdd2bb38e0c1e84ae029eb67d90afb9
Instruction ID: b61e0075830fb4705bf448a3efc63350f9e2ba71d549ea0b9310a447a218e5ca
Opcode Fuzzy Hash: e9b5f139f5911686aab457dd77e75ca6ecdd2bb38e0c1e84ae029eb67d90afb9
Instruction Fuzzy Hash: 5BA19130B09A19CFFB5AEB28D4516B973E1EF9A314F148179E44ED7282CF35E8468780

Function 00007FFAAC351C74 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f3f3ac2243aefc93d867aff9f84b11b6766a2fae42f689a8154bbd38b642d8
Instruction ID: c3a8edd34264f86e71c2c4d42108ada96b11e87de232a88fd7373d7b9876e561
Opcode Fuzzy Hash: 38f3f3ac2243aefc93d867aff9f84b11b6766a2fae42f689a8154bbd38b642d8
Instruction Fuzzy Hash: 71A1A520A09A4A8FFB599B1C8054B75B7D1EF5A304F5481BDD48FC72D3CE28E88A8790

Function 00007FFAAC351BFF Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bb89b5236d5b18af7454019dd28322dc1120afec78145bf3d19f7409d94f52
Instruction ID: 90359ad6b7f21cc798e396cb3fd68bde2d339cb4ca3f40e2b2b2674d72680838
Opcode Fuzzy Hash: f8bb89b5236d5b18af7454019dd28322dc1120afec78145bf3d19f7409d94f52
Instruction Fuzzy Hash: F9A1A520A09A4A8FFB59DB1C8055B75B7D1EF5A304F5480BDD48FC72D3CE28E88A8790

Function 00007FFAAC351BE2 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca03b7373eb9a9de493a075a980f1c3c93bbb6a0e8445ed3760ee4f256399fb
Instruction ID: ed25eb9ce24c957ff4c3e0cc341c52ae1619a8748d632fd53b0171e4cc4c5132
Opcode Fuzzy Hash: 7ca03b7373eb9a9de493a075a980f1c3c93bbb6a0e8445ed3760ee4f256399fb
Instruction Fuzzy Hash: DBA1B520A09A4A8FFB599B1C8454B79B7D1EF5A304F5480BDD44FC72D3CE28E88A8790

Function 00007FFAAC351C1D Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e7681cac44235bccb1193c859fbc201c40c16a9dc523850572b60fa5add0c3
Instruction ID: e7422817e01847b80beef1daf912dc863e74318fedd5391d83d846991850770e
Opcode Fuzzy Hash: d2e7681cac44235bccb1193c859fbc201c40c16a9dc523850572b60fa5add0c3
Instruction Fuzzy Hash: 79A1A620A09A4A8FFB599B1C8455B75B7D1EF5A344F5480BDD48FC72C3CE28E88A8790

Function 00007FFAAC351AD4 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c770da09901b11618663c4e7f8c8b9f15187afe56251628a3e21d5051aee76b
Instruction ID: 6e03b86b3b7a9cfc06673198440688bbaa31d13def1195e83b9e3b65a0c8e5d6
Opcode Fuzzy Hash: 1c770da09901b11618663c4e7f8c8b9f15187afe56251628a3e21d5051aee76b
Instruction Fuzzy Hash: 13A1A620609A4A8FFB599B1C8055B79B7D1EF5A304F5481BDD58FC72D3CE28E88A8790

Function 00007FFAAC351C61 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b0e4dc6087d80666c45f6f42a69d8b684683d7fce81c51768174c1859e38ab2
Instruction ID: c8d0e3b34cfdcb9447c7ef42b7b49279e0a0cabeb458e8381aecaaf46079abcb
Opcode Fuzzy Hash: 1b0e4dc6087d80666c45f6f42a69d8b684683d7fce81c51768174c1859e38ab2
Instruction Fuzzy Hash: 1FA1A620A09A4A8FFB59DB1C8455B79B7D1EF5A304F5481BDD44FC72D3CE28E88A8790

Function 00007FFAAC353383 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd6c17a63f5d623c7070b5d3ab6f54ed0c896cdd38a613e430aa0a2015b8d5b
Instruction ID: ffa1d0b184ec5a022296a63bb1122faf87cade7312b2d48f406235baabf4c88e
Opcode Fuzzy Hash: 5fd6c17a63f5d623c7070b5d3ab6f54ed0c896cdd38a613e430aa0a2015b8d5b
Instruction Fuzzy Hash: 0FA16271A18A0D8FEB98EB2CC449AB9B7E1FF59311F1441BDD04ED3292DE34E8458B81

Function 00007FFAAC351C43 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e98052f787875cfcdeca9ef45dba6f54fb987e08ef56ecf106c0f4ba393b7cb
Instruction ID: fb9faf66ba8b201ad2fa2dce2c4dd0c5291b39813b5e3e8ad4bff3501b94b07a
Opcode Fuzzy Hash: 8e98052f787875cfcdeca9ef45dba6f54fb987e08ef56ecf106c0f4ba393b7cb
Instruction Fuzzy Hash: 79A1A620A09A4A8FFB59DB1C8455B79B7D1EF5A304F5481BDD44FC72D3CE28E88A8790

Function 00007FFAAC1A6B15 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e188ade1de63caf64391d2625aad4e680a29a7df29d4d7e1805f223ee65fc489
Instruction ID: a1b68d2009895c07f896dbba05e0aa0f63b287fbc556c8e7a66e8ae589002e8d
Opcode Fuzzy Hash: e188ade1de63caf64391d2625aad4e680a29a7df29d4d7e1805f223ee65fc489
Instruction Fuzzy Hash: 15116034A09A4ECFEF95EF28C809AAE7BF0FF25304F54456AD45DC31A1DA349544CB80

Function 00007FFAAC1E7BA0 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25dab9f60a0cd94cbab10916a68b46a39a88f601e44c9430d92f0a5fae8edb7a
Instruction ID: f26e18102954b9ec73584dbf0f8cacc051230314fec2a2d5637299126498fcc4
Opcode Fuzzy Hash: 25dab9f60a0cd94cbab10916a68b46a39a88f601e44c9430d92f0a5fae8edb7a
Instruction Fuzzy Hash: B671D330B19A09CFF7A5EB689854AB5B7E1FF9A310B14457AD40EC3292DF25E849C7C0

Function 00007FFAAC3564E8 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665765f0d7711d109a6c38f851ea95f06f09d1480bc8c19350ff98e7b99d0d3d
Instruction ID: c4c6a95e7675dc114afa1b428edcccb9d69dc276bf273b206613814ce348cdf8
Opcode Fuzzy Hash: 665765f0d7711d109a6c38f851ea95f06f09d1480bc8c19350ff98e7b99d0d3d
Instruction Fuzzy Hash: 9A81D270A1DE4A8FE758DB29C445A76B7E1FF96300F00857DE48EC3296DE24F8458792

Function 00007FFAAC1829D7 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee5397155f389cc1cc12546acb13068121088e2d78de2efd3468d6068e412dc
Instruction ID: 82bb77ed0be4f487566d42a4bf4428421073b96cb7c33088d8ed541d502e7c92
Opcode Fuzzy Hash: 7ee5397155f389cc1cc12546acb13068121088e2d78de2efd3468d6068e412dc
Instruction Fuzzy Hash: E9716E30B0D649CFE79ADB18D450B7877A2EF5A304F5441BAD00EDB2D2CE29AD46C791

Function 00007FFAAC350430 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 858e8fb2d70f57b6957c99513a9894ba4c4ae943d977a0400534082d8135783f
Instruction ID: 69ca2cc2210d461d6e93de42ba42ea908bde6dc73ba38f056ab1545700fc64ba
Opcode Fuzzy Hash: 858e8fb2d70f57b6957c99513a9894ba4c4ae943d977a0400534082d8135783f
Instruction Fuzzy Hash: 2F516962A0DE4E4FE399977C884A9B5BBD1EF8A21070441BED04EC7297DE18AC068391

Function 00007FFAAC1E6D0E Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d27b0552286442ded4b4a9e3fb96aa793a9f5d5d458a6a8b2321622cee5709d
Instruction ID: 366e2462577a6f17bee971376ce6166d3965f8fdd4862c4f35731c4d09dec42f
Opcode Fuzzy Hash: 0d27b0552286442ded4b4a9e3fb96aa793a9f5d5d458a6a8b2321622cee5709d
Instruction Fuzzy Hash: FE510534A0890ECFDF85EF58C491AAAB7B1FFA9300F544069E40DD7295CB35E855CB81

Function 00007FFAAC1A15E9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c73208c532001ec48219efcb8acfa18bc966c07fcf510dc44ed1bc73ee996d57
Instruction ID: 89395dd8e1b4df55b77349553e1b0a3956beb5e37895de3a31b042d513c1f507
Opcode Fuzzy Hash: c73208c532001ec48219efcb8acfa18bc966c07fcf510dc44ed1bc73ee996d57
Instruction Fuzzy Hash: A771D971A0965DCFEB95DB18C898BA9BBF1FF5A300F1441EAD00DE72A1CA349D85CB40

Function 00007FFAAC356CD5 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7140cf34976733e9870e14beedcef4c5c15693f0ad551afd8bd70bb4b1b29e0a
Instruction ID: 18cfb6025f6a76b65ee93b0666a25f1a04b47a84f380968080daa3443f67a751
Opcode Fuzzy Hash: 7140cf34976733e9870e14beedcef4c5c15693f0ad551afd8bd70bb4b1b29e0a
Instruction Fuzzy Hash: B2511735A0BE4D8FFBA497298459AA8BBE0EF5A310F1441BDD04DC7392DD14EC0987D1

Function 00007FFAAC1E8E88 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65b50697602abbac35e5e00ad5a0d5a2a28c0862f16d04213f208580f75028a
Instruction ID: bd6ea7a18c7d3434f3fe92082673b77eb01af6b16e6e708ad39d9bae5d1b9c85
Opcode Fuzzy Hash: d65b50697602abbac35e5e00ad5a0d5a2a28c0862f16d04213f208580f75028a
Instruction Fuzzy Hash: 8E51703071DA498FFB99EB28D855AB637D2FF56314F1040ADE44EC7282DA35E816C781

Function 00007FFAAC1E7E20 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e63ee6d734c13a95cb5ffc49849aefd8d8cec1908befb6827d3df01edd86c853
Instruction ID: 975746ad8384568e5eefdb37b16186f0f8bcef32fcda93973a15dbbeb86b8547
Opcode Fuzzy Hash: e63ee6d734c13a95cb5ffc49849aefd8d8cec1908befb6827d3df01edd86c853
Instruction Fuzzy Hash: 6C41F030B0DB498FF756AB2CA444675BBD0EF57314F1442BAD89EC7292EE24E84683C1

Function 00007FFAAC1E94C7 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c36b2b84bc220d3ca5f1183e80eff8a9ab5e8e6c9b262f1c3d7b42f104954a9
Instruction ID: 32b91af5fc103de7623634be984d07ee01d3b99036b6baaea38c47b510ba9e3a
Opcode Fuzzy Hash: 7c36b2b84bc220d3ca5f1183e80eff8a9ab5e8e6c9b262f1c3d7b42f104954a9
Instruction Fuzzy Hash: 81512470A09649CFEF95DF18C490BA97BB2EF9A300F1481A9D04DDB296DB35D885C781

Function 00007FFAAC1EB201 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5ef7397d9085ad95c3672a21a734ed53703452c5f3b317ac538b93818988d7
Instruction ID: 84846300ecb0059fac7b81c64a939a48f05d4c8d4cd7ccfda7dbadb9c902d1af
Opcode Fuzzy Hash: fa5ef7397d9085ad95c3672a21a734ed53703452c5f3b317ac538b93818988d7
Instruction Fuzzy Hash: 2F41A130B19A098FF6AAEB2C945567573D2FF9A310B4481B9D00EC7692CF25F8468784

Function 00007FFAAC3507FE Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cf53335c7b396ae4b5952997b8416c4956e925c248e064470121acc86f2c7b
Instruction ID: 3174d31e35c1fe9ab38722a15ccca312b5f98b99c1b161048004ffddaf620c94
Opcode Fuzzy Hash: 57cf53335c7b396ae4b5952997b8416c4956e925c248e064470121acc86f2c7b
Instruction Fuzzy Hash: 9E41B23050DA8D8FEB589B1C9449AB9BBE1EF96310F14417EE48DC3292CE36E846C7D1

Function 00007FFAAC1E7DED Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94bdc9c9c5ef0b27bcaf9e327e0e06ef9de878e3a4b98e448a8bbd98faeffb8c
Instruction ID: 780cfe14fb0d5147e274b857f3a929161a2fa78abbe00aeed03d62198668af42
Opcode Fuzzy Hash: 94bdc9c9c5ef0b27bcaf9e327e0e06ef9de878e3a4b98e448a8bbd98faeffb8c
Instruction Fuzzy Hash: 0D41F52160EA8A8FF786AB2898146717BE1EF57314B1441FAD48DC7293DE18DC0AC3D1

Function 00007FFAAC18269C Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935a51b997dcfc3f2c36a1f9b494fcc6fa64bdeb7000275bb82265a7e4c9445c
Instruction ID: 6aefe3c661ace7fed1501db2ed6968e7b16cb7153e59ff0c7efb55bc845f91ae
Opcode Fuzzy Hash: 935a51b997dcfc3f2c36a1f9b494fcc6fa64bdeb7000275bb82265a7e4c9445c
Instruction Fuzzy Hash: 3441F721A0E6898FE757972884246B5BBA1DF63310F1981FBD44DCB2D7CD189D09C3C1

Function 00007FFAAC18CB86 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC18C000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC18C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac18c000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a157404e18f0b0c711bd24e954be9fd2fbf6748cc18082029051d23cab42a5
Instruction ID: 253a63ea57ae9ff7ab158ce92b42057977d6843e4cc2936be49125f16a7617a5
Opcode Fuzzy Hash: c0a157404e18f0b0c711bd24e954be9fd2fbf6748cc18082029051d23cab42a5
Instruction Fuzzy Hash: 3F419471A0D549CFEB42DBA8C8549F9BBF1FF5A310F0445B6D009D71A2CB78A94ACB90

Function 00007FFAAC1E77FB Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f9ca9d9ea2b847081f4bfa2fa41e8ec261cfe240a775307ecb66936c4c4ef6
Instruction ID: 8d4a05047757bc44092156929656a372a813b6e798b83b4f8a8edc9d127eef4b
Opcode Fuzzy Hash: 05f9ca9d9ea2b847081f4bfa2fa41e8ec261cfe240a775307ecb66936c4c4ef6
Instruction Fuzzy Hash: C931F231A0DB89CFE746EB2C98105E57BE1EF9B314B1440BAE04DC7283CB21D85ACB91

Function 00007FFAAC2B3109 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1691791710.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac2b0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2a1c1163e23afdfe15361c5bd1b257a75252288f35794288489842f129b5fd
Instruction ID: b45c6571943b95d96b0d3c59e396616b925fb6737beb5a9666f21e54bd2c1a7c
Opcode Fuzzy Hash: df2a1c1163e23afdfe15361c5bd1b257a75252288f35794288489842f129b5fd
Instruction Fuzzy Hash: F0413F71D1A64ACAFFA4EB5884457B9B7A1FF5A300F548175D00DA2286CF38A98DCBD0

Function 00007FFAAC35339C Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3796bed1ec1aa1b00509e1021b1556f01c068e3ab994cfe31bfbb08d15ee05b
Instruction ID: 7baf9871cd43be13243efe32478236f52642344f682ae99642e46ffb333421c8
Opcode Fuzzy Hash: c3796bed1ec1aa1b00509e1021b1556f01c068e3ab994cfe31bfbb08d15ee05b
Instruction Fuzzy Hash: F831C87191CB0C4FEB68EB2CD85A9F9B7E5EB95320F00417FD44ED3252DA20A9494B81

Function 00007FFAAC1E49C8 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386ddea0f13a65d2034465e96c36848cd7c2a14d50f8ae87d69770f20042abe0
Instruction ID: 921ba9ee3706d639a1c09b480a141a28623a90f189f3d7567350c2b1fe405ab1
Opcode Fuzzy Hash: 386ddea0f13a65d2034465e96c36848cd7c2a14d50f8ae87d69770f20042abe0
Instruction Fuzzy Hash: 56313830A18A4E8FEB51EF28C844ABA77E1FF89305F0045B5E81ED3290DF38E8548790

Function 00007FFAAC1E6C1C Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d10864d41914ddd84987fcab1dfdda1bd31979f7b9cf933ae8e16a903d46c40
Instruction ID: 3c0368ef8b5ed5415db6949842a572e507a96c18578d274a4b7ab0588b01c458
Opcode Fuzzy Hash: 2d10864d41914ddd84987fcab1dfdda1bd31979f7b9cf933ae8e16a903d46c40
Instruction Fuzzy Hash: E6318F7160DB889FDB49DF6C98545E93BE1EF5A315F0502BFE08ED32A2CB6498098781

Function 00007FFAAC1E7F79 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae856a6f30da0117c227d0b6d47e60302f91c8c52c6d8c8abc162fa1d397922
Instruction ID: b959b9984a7d7086621b5e5460d90bd0ecfc6c100311fb14c469a7c46383801c
Opcode Fuzzy Hash: dae856a6f30da0117c227d0b6d47e60302f91c8c52c6d8c8abc162fa1d397922
Instruction Fuzzy Hash: 4D213A62B0EA498FF35A936C5C459B17BC1DFC636070982BAE05EC72A2DD14EC0A83D0

Function 00007FFAAC356030 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7bac3b5ca672e088ef6c41e8bfeae91ba2390e2d9467d07692f9c2d3ed36b6
Instruction ID: 4d2e670c0eefa2bbe3b42b7aa97e91b16e7c2ed87a77f7424c07c6b2005157ff
Opcode Fuzzy Hash: 6e7bac3b5ca672e088ef6c41e8bfeae91ba2390e2d9467d07692f9c2d3ed36b6
Instruction Fuzzy Hash: C821B921B19D0E8FFA94E75C8498AB5A2E1FFA9350F54857ED00EC3295CE74EC0987D1

Function 00007FFAAC2B332F Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1691791710.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac2b0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe47c53cf11c40de8b4320e2a3047e9af6a88484e5298ebd10d431ceb714eba
Instruction ID: 93a944bb5d0f2cfb4254d4b99b8c7a739b5b51463ec6fe61d82d9e8ab48ccbeb
Opcode Fuzzy Hash: efe47c53cf11c40de8b4320e2a3047e9af6a88484e5298ebd10d431ceb714eba
Instruction Fuzzy Hash: 99310B71E19A1A8FEFA4EB58C4866AD77B1FF59300F508079D00DE3246CF34A8898BD0

Function 00007FFAAC1E91F5 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670260048b06f5d9aaed44d8838f0026c1a58e2127e728679152f72b9780485b
Instruction ID: 7855562a361a86d022bd6549e55a4475ef7811a59b8ae016821c3fb7f857717d
Opcode Fuzzy Hash: 670260048b06f5d9aaed44d8838f0026c1a58e2127e728679152f72b9780485b
Instruction Fuzzy Hash: EA31DD70A15A0DCFEB95DB18C854BA9B7E1FF5A340F5481A5D40DD7291DB34EC85CB80

Function 00007FFAAC1A1D62 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7847b2ae0531351f2830e8cec598eb12bbee5f30519d9c77950fde63c2915002
Instruction ID: 1b1d76775d2d77417d156cec4e89cd186ecd612e73cf446bea8cefb8d4377791
Opcode Fuzzy Hash: 7847b2ae0531351f2830e8cec598eb12bbee5f30519d9c77950fde63c2915002
Instruction Fuzzy Hash: 1731D670E0951DCFDB99DB58C895AACB7B2EF4A300F5081A9D00EE7295CE35AD85CF44

Function 00007FFAAC18FD01 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC18C000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC18C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac18c000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d5b278b9a67097747033059a2e6ebbd6cd9b4e24cb8a8cd8ee48258a70221b
Instruction ID: 2ca7e4dcce08c6bb0a70bf99369e4cc1db4c68041d7d0cd7b9e17895667c0614
Opcode Fuzzy Hash: 82d5b278b9a67097747033059a2e6ebbd6cd9b4e24cb8a8cd8ee48258a70221b
Instruction Fuzzy Hash: 8B41C97090891D8FDFA8EF54C854AE9B7B0EF64301F1041EBC40EE32A1CA75AA84CF91

Function 00007FFAAC1E7FA0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f110f03bd535bf57fd001e817eda0839d05724bd1e999e8c5fd9d7fb7d313be
Instruction ID: 47103c6546e5ea09f4e454046360f5e52e5dbf704f0c40f45086bf49fef80de4
Opcode Fuzzy Hash: 9f110f03bd535bf57fd001e817eda0839d05724bd1e999e8c5fd9d7fb7d313be
Instruction Fuzzy Hash: 1E115922B1EE0A4FB3A9A65C9C4597277C1EFC636070582BEE10EC3296DD14EC4682C0

Function 00007FFAAC350510 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6474fe15775009dae8c39e6dcfa38973cd5b9772248ced6a88a78764baa870b
Instruction ID: 3d2ca5cb1a62565b6acbb458f08642d0b18acb9a4e688fd6d2c8e356f3861085
Opcode Fuzzy Hash: d6474fe15775009dae8c39e6dcfa38973cd5b9772248ced6a88a78764baa870b
Instruction Fuzzy Hash: 35116D22E1DE0D4FF268A66D98499B1F7C1FB86350744827DE00EC329ADE25FC4642D0

Function 00007FFAAC355500 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b353f99176f8ac421f91863b6d83669c7c7858bbf5cd9d77e75e747d5938b939
Instruction ID: 25252a7d77d5bfdde9dffb9b35c2644b0998b21ea3109e545e6ea3244d8e6f2d
Opcode Fuzzy Hash: b353f99176f8ac421f91863b6d83669c7c7858bbf5cd9d77e75e747d5938b939
Instruction Fuzzy Hash: 1D213034615A4E8FEB84EF28C454BAA73A1FF59304F504569E41EC7285DF35E855C780

Function 00007FFAAC1E6580 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968035b2a99270f23a0d6296639475f5379cd4cb42d74419ce5f72f5f8110d47
Instruction ID: 2a6e48e9807c73689d252da5f57c85ee9c12947bf843b7aaaa0ba24526a5926d
Opcode Fuzzy Hash: 968035b2a99270f23a0d6296639475f5379cd4cb42d74419ce5f72f5f8110d47
Instruction Fuzzy Hash: 4D11D52061CA154FF795AB1CA448B717BD1DFA6320F08497AE48CC32F1DA15D9C5C381

Function 00007FFAAC1E07D9 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ef325bf06b82c78d9e8be29edc4d63c9f7bd30505355eea5d081f4edfe5fa9
Instruction ID: 7ffa9dc48bb1c12c3fca7b99d03b0fa93e091c96dc80537b312b1428e175a1a7
Opcode Fuzzy Hash: 11ef325bf06b82c78d9e8be29edc4d63c9f7bd30505355eea5d081f4edfe5fa9
Instruction Fuzzy Hash: E4313670E09649CFEB56DF58C454ABD7BF1EF5A300F0081AAD409E7291CB38A959DBD0

Function 00007FFAAC1E9299 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e280e0ea1e7d480c35d665202dedf2fe0f75d7fe52d37ff0328bb9d0caf0d3d
Instruction ID: b3ac159a3869994b18f646644cfa357cd0709ddac6db53adb62c829e3e0fc065
Opcode Fuzzy Hash: 9e280e0ea1e7d480c35d665202dedf2fe0f75d7fe52d37ff0328bb9d0caf0d3d
Instruction Fuzzy Hash: 94211D30A19A09CFEB95DB28C854BA877E1FF56340F5481A5D40DDB292DB34EC45CB40

Function 00007FFAAC2B3545 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1691791710.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac2b0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d7942f87368e53b8e23765f6e5b14d4a2d5e7c16595c19fd3c889d59ea4cdf
Instruction ID: aecfb42948c996f66bd918f96371dfa054ac115a8c0bf1ecfefa7b03e026451f
Opcode Fuzzy Hash: 10d7942f87368e53b8e23765f6e5b14d4a2d5e7c16595c19fd3c889d59ea4cdf
Instruction Fuzzy Hash: 4A21C975E19A1A8FEBA4EB5884857BD77A1FF69300F508165D00DE3245CF38A8898BD1

Function 00007FFAAC1E5617 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54937fac32585d430f1770c7ca8adcc108e7e51b84c4bbf71e3fa5050215a8df
Instruction ID: 8087ddb701bf7db202e9f65420d02e3c0602de5ee5d2b24c5ac68de7912106e8
Opcode Fuzzy Hash: 54937fac32585d430f1770c7ca8adcc108e7e51b84c4bbf71e3fa5050215a8df
Instruction Fuzzy Hash: DF110120B28A194FF745A76C90413FAB3D2EF89300F10853AA04FC3687CE68E84A43D1

Function 00007FFAAC1E08B8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f8a5c9a1094b1b9d01635b42ff6593b827f5af28063142c3c575fe53cd710e
Instruction ID: 7b6b22fb528800b3f907b4619159d4b14e2bd575231f5ef5ea25fcc619db7094
Opcode Fuzzy Hash: c3f8a5c9a1094b1b9d01635b42ff6593b827f5af28063142c3c575fe53cd710e
Instruction Fuzzy Hash: DD21D770E0860DCFEB85DF58C454AADB7F1EF5A304F108169C41AEB291CB39A985CF90

Function 00007FFAAC1AAFD1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ac8aa9379cac0348e8eac87cdb5c191dcb1654039c91f66d9eebe71d5a8572
Instruction ID: b9f2173bb5f95cec6615857a3b675f596231d6e9ce92053a1b3d8b3c84db7246
Opcode Fuzzy Hash: e1ac8aa9379cac0348e8eac87cdb5c191dcb1654039c91f66d9eebe71d5a8572
Instruction Fuzzy Hash: F811BF71908A8CCFEB55EF28C485AEC7BA0FF59300F0440AAD01DC7191DA35E999CB80

Function 00007FFAAC18265C Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f733cf974edf205bbfc7a4d8061946c6e1c9bf809156732c1f5522754fb9bd3
Instruction ID: 44a59c36cbbc0c1354e16bf2875c146b170a698e8024ec5cf76972305235351a
Opcode Fuzzy Hash: 8f733cf974edf205bbfc7a4d8061946c6e1c9bf809156732c1f5522754fb9bd3
Instruction Fuzzy Hash: 7511C421B0D9568FF79B971880647786792DF67344F2D41BAC80EDB2C6CD5C9D4683C0

Function 00007FFAAC2B3C0B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1691791710.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac2b0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f07bc745aed9ce38d1090a523829ef54318af717de8ea5e42c14bb134144723
Instruction ID: 2b99426a6fb6e8a52107c7638d188c69f424f7e3f74b2261d982f9c90e04b4c3
Opcode Fuzzy Hash: 7f07bc745aed9ce38d1090a523829ef54318af717de8ea5e42c14bb134144723
Instruction Fuzzy Hash: 1E21A330919A1DCEEB98EB68C4956ACB7B1FF59301F944179D00DA3292CF35AC45CB80

Function 00007FFAAC1A2720 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fba564f52426ce33eb1756965ef7fb991410daf8de7cd7fde0f89caf897f429
Instruction ID: 0c08a6a0929329e44c7dd7af39750f853b22bb30123d4a1b9b347f728f1f11e7
Opcode Fuzzy Hash: 3fba564f52426ce33eb1756965ef7fb991410daf8de7cd7fde0f89caf897f429
Instruction Fuzzy Hash: 4521A474A0962DCFDBA9DB18C885AA9B3B6FF59700F1041E9D00DE7251CB75AA80CF40

Function 00007FFAAC2B3650 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1691791710.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac2b0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106687336f97b4802a5acb2f54409e86cab9a3bfc5ff984681df1f3090ad18b7
Instruction ID: 4e9401dc58c08ef463f24d7b6eaa3866ccc7a99de0ea4744317d65de79e50c3c
Opcode Fuzzy Hash: 106687336f97b4802a5acb2f54409e86cab9a3bfc5ff984681df1f3090ad18b7
Instruction Fuzzy Hash: A421DB75E19A5ECFEBA4EB5884457A977B2FF59300F508065D00DE3245CF38A9898BD0

Function 00007FFAAC182B20 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb3d916304841fc9d6fe56cf0524fb76d6e47973c71cf929247bcea2a4c327ed
Instruction ID: 27dba3d68e5f337a5fdf9ec7eefbac3190dbfbf686061f0279256139edc3c50f
Opcode Fuzzy Hash: eb3d916304841fc9d6fe56cf0524fb76d6e47973c71cf929247bcea2a4c327ed
Instruction Fuzzy Hash: 1211A835708918CFDB95EB2CD895BA877F2FF69310B1541A9E009DB262CA35E842CB40

Function 00007FFAAC1E2469 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0bffc5f1821fb7faa05453f299cb551196ba73b7ab4b28bcce11b5a02da85f4
Instruction ID: 666b7bee54cd3cd9c24690fc37514a71a734fb2c981797c24886cb512783c12e
Opcode Fuzzy Hash: f0bffc5f1821fb7faa05453f299cb551196ba73b7ab4b28bcce11b5a02da85f4
Instruction Fuzzy Hash: C1114F70918A4D8FDF85EF28C859AE97BF0FF29304F01416AD409D3261DB34E544CB80

Function 00007FFAAC1E5080 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbce768ae8893a7ba2b36a26e66364598fcf5c9dfde99b97accc20b8a88400b3
Instruction ID: 6eb6e33bc3ac63fd4174929be6571fe11cd218a2bc7c083e44f97a8988b414bc
Opcode Fuzzy Hash: dbce768ae8893a7ba2b36a26e66364598fcf5c9dfde99b97accc20b8a88400b3
Instruction Fuzzy Hash: 7F01D66290D6C94FF742A7B8A8660E9BFA0DF03214F0886FBF44ECA193DE1494494381

Function 00007FFAAC1A27A8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c4244ef2b64f99db4a3121511771c1bbfee72a126f3c0072ba1952e689438d
Instruction ID: 8054dd97e3f36e59914b014331a1549610f64f48cfde03f17c27301719274759
Opcode Fuzzy Hash: 37c4244ef2b64f99db4a3121511771c1bbfee72a126f3c0072ba1952e689438d
Instruction Fuzzy Hash: 1B118674A0961D8FDBA9DB18C885AA9B3B6FF59700F1041E9D00DE7651CB75AE80CF40

Function 00007FFAAC356C69 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895a01a6ffb8056e9e877ea4fe9691182440e8df5cf5d5b8e16e1b9dffdae097
Instruction ID: 3858d79024c9214a0d742a6ca6743523bcafa32ba993475c9684857f6be3002e
Opcode Fuzzy Hash: 895a01a6ffb8056e9e877ea4fe9691182440e8df5cf5d5b8e16e1b9dffdae097
Instruction Fuzzy Hash: 8401DB51A1DF494FE795A37C54959F2B7E1DF9621070482BFE00EC329BDC64E84A83C1

Function 00007FFAAC1808A9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9659fc6d2dc69e0bb877b18649ab86e72c6760200bb5363a5ff1347e6a52c1da
Instruction ID: 584a4cda26f2f9f32e04d756324b3e08d8df58c277e8ed2e7a65088519040e84
Opcode Fuzzy Hash: 9659fc6d2dc69e0bb877b18649ab86e72c6760200bb5363a5ff1347e6a52c1da
Instruction Fuzzy Hash: 1E01886194F7C84FE34797388C650A9BFB0EF57100B4A41EBD488CB1A3DA28595DC352

Function 00007FFAAC1E42AA Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5f7dedb2ef96acc1fccd5852f4bfbf9527b530bba3364b5623e472340eb0ac
Instruction ID: 69f6ff0f4fec26fc07c7ad672cc1bdcfcf1b3ed83079bcb067e98e832f27e49d
Opcode Fuzzy Hash: ac5f7dedb2ef96acc1fccd5852f4bfbf9527b530bba3364b5623e472340eb0ac
Instruction Fuzzy Hash: 0C112E30B0A519CFEBA6DB94D4507BCB7B1EF56305F5081BAC00ED6291CF35A949CB80

Function 00007FFAAC1A1FE0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fca2e616fb5086649db54aeca60c968e5fc80f8ed7300dc820d1f75a2f80ea
Instruction ID: 7ac26b62e9afc483a8c06e9d13755f824f3f768b77132997bf0574d01d3ae70b
Opcode Fuzzy Hash: 71fca2e616fb5086649db54aeca60c968e5fc80f8ed7300dc820d1f75a2f80ea
Instruction Fuzzy Hash: 9E119B34A09A5DCFDBAADB58D894AA9B3B5FF59701F1001E9D00DE7251CB34AE80CF40

Function 00007FFAAC1E8941 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da93575ee2ed915bda9e69402975498cebe596868486bbc71d9b42bc2d8e50d6
Instruction ID: 52a5ee18acb31a9f4a050344c8f9bbecd680a44246925d21866e514f79999dfc
Opcode Fuzzy Hash: da93575ee2ed915bda9e69402975498cebe596868486bbc71d9b42bc2d8e50d6
Instruction Fuzzy Hash: C301F961A0D7458FF747932884052B57FD1DF86220F0946BAD04CC60A2DE58958A83D3

Function 00007FFAAC1E16B6 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bdd3cceca84b32d4e437af7a419ff56528480b3dc0cc6cf31281ef5431ffd19
Instruction ID: fba07f9f62fe3eb3be0ef4b46bc18f3e1ec84942fffd324c6d3dff4d05b35a48
Opcode Fuzzy Hash: 1bdd3cceca84b32d4e437af7a419ff56528480b3dc0cc6cf31281ef5431ffd19
Instruction Fuzzy Hash: A3113D30A0A649CFEB55DB54C954BA8B7F1EF5A300F1441FAD00EEB292CB399E44CB51

Function 00007FFAAC1E6098 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924bddf81324279e0a09f77e057b4dbc7bad30e49fcef6339c289d3ed07b22e4
Instruction ID: 68cc891be140cf57695bfda2299a8a9c96744b708daeafa75b72221ffe1b98f9
Opcode Fuzzy Hash: 924bddf81324279e0a09f77e057b4dbc7bad30e49fcef6339c289d3ed07b22e4
Instruction Fuzzy Hash: 53011A30A19A2CDFAF55EB589441AECB7A2FF4D714F444169D40DE3241CB25E84187C1

Function 00007FFAAC1AB039 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0b2a874588e971b615decbd201688e33b46f5cbdba90990a0fe73379364ffe
Instruction ID: ecbdaca6e795dd598f26691667964811c1d8fe58d4a25740145c512f75b36dfd
Opcode Fuzzy Hash: 8b0b2a874588e971b615decbd201688e33b46f5cbdba90990a0fe73379364ffe
Instruction Fuzzy Hash: 22011E7090968CCFDB45DF28C895AE97FB0FF69300F4541AAE44DC7162D635D554CB81

Function 00007FFAAC2B3B9C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1691791710.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac2b0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfaae5892dcc8928c213b19bf30ad725bd527d85bd03854c0341cd4b52effc67
Instruction ID: cbf1d6861d546832855d64635fdde81fc148bfdb10358da7ce04d227f984cefc
Opcode Fuzzy Hash: dfaae5892dcc8928c213b19bf30ad725bd527d85bd03854c0341cd4b52effc67
Instruction Fuzzy Hash: 4111E63090961ACFEB58DF94C091AFDBBB2EF59340F904078D009A6286CF35AC89CB90

Function 00007FFAAC1A9321 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC19F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC19F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac19f000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c9756a37e4b5f4aac540c328193db343786953a496a63a025988609e80dabab
Instruction ID: 5be4cf8864e5ba31580ffe7d7238be442933aa9eda6297d814fc6824f112b682
Opcode Fuzzy Hash: 8c9756a37e4b5f4aac540c328193db343786953a496a63a025988609e80dabab
Instruction Fuzzy Hash: A5017C70A0964B8FFB59CB44C8506BDB7F2FF16700F1445BED00AD62C2DA7969048B81

Function 00007FFAAC1E0CE1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd64c1ceda940adde8af6f7eb3ff456eff3770d64604424a87863d39249d81b6
Instruction ID: 3013ffe86ef6d74d4cc7b16a0a2c3938267e3d85e5bca6713d947a436cdeb951
Opcode Fuzzy Hash: cd64c1ceda940adde8af6f7eb3ff456eff3770d64604424a87863d39249d81b6
Instruction Fuzzy Hash: 3A018470A09549CFE75ADB148454AF8B7F1EF5A300F1441FAD00EE7192DE34AE88CB51

Function 00007FFAAC2B314D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1691791710.00007FFAAC2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac2b0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ac11ebbc23184ee482e8fc2b1529bda2967ac4e9fb4af2b8cd33c883e420b7
Instruction ID: 7aae53f6ed5ee745e262830b097df3db9cd9dd2e37a066faa77c9fad0e5df578
Opcode Fuzzy Hash: a6ac11ebbc23184ee482e8fc2b1529bda2967ac4e9fb4af2b8cd33c883e420b7
Instruction Fuzzy Hash: E401B771E1955A8EEBA4EB5884456A977A1FF59300F50817AD00DA2285CF38A9898BD0

Function 00007FFAAC1E32F9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3405bc9d9a42b7aa67ef12501cf17f81bd416cce381590ac0365ad612df6fe36
Instruction ID: 2b8c65f9f9a054f6ba229ddc9caa3c2bf31e58276cd1ffb07ac25d9452ab8c54
Opcode Fuzzy Hash: 3405bc9d9a42b7aa67ef12501cf17f81bd416cce381590ac0365ad612df6fe36
Instruction Fuzzy Hash: 8701483490DA8D8FDB85EF68C858ABA7BB0FF29300F4545AAD419C72A2DB349544CB40

Function 00007FFAAC355020 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8e75b89367b2bad8ac9898eff8e0936e8591401a1203a288182a6610fc8cd8
Instruction ID: 201040edb1c96229697ac0e88027d14178fb5f3a73caadf3ac03329a0d97b0dd
Opcode Fuzzy Hash: 3e8e75b89367b2bad8ac9898eff8e0936e8591401a1203a288182a6610fc8cd8
Instruction Fuzzy Hash: 0CF05411F29D0D4EABA8B67D5449DB6E1D1DB99210B50C67EE00FC329ADC69F84943C0

Function 00007FFAAC18C660 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC18C000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC18C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac18c000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4559b949eb887ef4fb66cd6c964408b7e6ebf92d260a80e0dda71c6befb4ca0
Instruction ID: 288a18f42a17bdc713312f050749cd1bcf492915d96734f91034abc743d7e081
Opcode Fuzzy Hash: d4559b949eb887ef4fb66cd6c964408b7e6ebf92d260a80e0dda71c6befb4ca0
Instruction Fuzzy Hash: F8019275E0E649CFE702AB64C8146BAB7B4EF46300F008176E406C729ACE34A619CBD1

Function 00007FFAAC1E06BD Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce23c783958534633dcf11e9a78a8b2b57b61d03efc736cb2776b559c99f231
Instruction ID: e4c360beed633985e1a6dc665c36e19e4fd08f555f1399ffbead3db73390a372
Opcode Fuzzy Hash: 8ce23c783958534633dcf11e9a78a8b2b57b61d03efc736cb2776b559c99f231
Instruction Fuzzy Hash: 32014B7091964DCFEB55EF28C8496EA3BE0FF6D301F4041AAE80DC7261DB34E5958B80

Function 00007FFAAC1E510D Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab4c38c34531a716a060cdd1d983e453e561ffb78c00a86856508eb34dd681a
Instruction ID: 0484d46899e72b1471286293600987c9539a5ae8421566ea3bfd13508f4758d5
Opcode Fuzzy Hash: 4ab4c38c34531a716a060cdd1d983e453e561ffb78c00a86856508eb34dd681a
Instruction Fuzzy Hash: 11F0F471A19789CFE745DF6888590A9BFF0EF56200F4541A6D40DC7182DE3495498B80

Function 00007FFAAC1E0B4E Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2fbf6ec0f3d6476094c177e2848748122fe468a064c1e796eb41aade2ef87b
Instruction ID: a79834708771f0a580076b1a9b101aa8eafcafa4987636ea287a548a67184224
Opcode Fuzzy Hash: db2fbf6ec0f3d6476094c177e2848748122fe468a064c1e796eb41aade2ef87b
Instruction Fuzzy Hash: F1012834A58649CFDB19DF54C4925BDBBF1EB1A709F10416EC542E7291CB34A946CB80

Function 00007FFAAC1834D5 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c773d82175a784f399a84a55e0b74bf712d1349cbeee32eabdba1db09ec288b
Instruction ID: 460d759bbd8b6b4fae8a844e9260c1d4347660ea51f39697d4095deb6b5f25d7
Opcode Fuzzy Hash: 2c773d82175a784f399a84a55e0b74bf712d1349cbeee32eabdba1db09ec288b
Instruction Fuzzy Hash: 97F0315694F7C14EF7574AA80C25075BF60AF67210B4D40FBD0C88B5D7D409994AC3A2

Function 00007FFAAC1827B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d8ce461c6460bc6b5a7668becbb4f8b0b65dcdbe6203ee26b2f3d1628ba69e
Instruction ID: ff0a07d87f6d2a2d908f087425162ae9a2584b38eeb3c7aeeea3885add304a8d
Opcode Fuzzy Hash: 03d8ce461c6460bc6b5a7668becbb4f8b0b65dcdbe6203ee26b2f3d1628ba69e
Instruction Fuzzy Hash: 6001E731A08909CFEF95EB48C488FB877E0EF2A310F0541B5D00DDB2A1DA68ED84DB81

Function 00007FFAAC180929 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4591ddf02aac8cfc7bbefb2737314cd7af2c40d0e3182dfb2360b1879cf23169
Instruction ID: 8e7c5f453fa12a4a8d6824c401d68f3189c50288a85d0877ecae62d33423cd52
Opcode Fuzzy Hash: 4591ddf02aac8cfc7bbefb2737314cd7af2c40d0e3182dfb2360b1879cf23169
Instruction Fuzzy Hash: 47F0986299F3C98FE71757605C320A57F70AE07111B5E42D7D488CE4A3D609995CC792

Function 00007FFAAC197737 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC197000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC197000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac197000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af420020514980712e18d4dce800562bde561745bd296af5660fbc68b32d3d6
Instruction ID: c09fa431eb9c59144b0934e148f40874217058480d2795df23718d73abe9177d
Opcode Fuzzy Hash: 0af420020514980712e18d4dce800562bde561745bd296af5660fbc68b32d3d6
Instruction Fuzzy Hash: 00F0B630E0AA598FEB66EB24C8547F8B6B0EF5A341F0041E6D00DD6691CF786AC48F40

Function 00007FFAAC1E629A Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d45ae3e6cab5ab2ea9ef2ff486948669cdcced734508b69057b521836d814c
Instruction ID: c7a6d5551b2930f737ff290560fb5157fcb50760a86b7c0b2149cc2294cf0b51
Opcode Fuzzy Hash: 01d45ae3e6cab5ab2ea9ef2ff486948669cdcced734508b69057b521836d814c
Instruction Fuzzy Hash: E0D05E22B2CB240B6528661C7C120B8B3C1E789B3470002BFF40DC338ADD19AC4101C6

Function 00007FFAAC1939D4 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC191000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac191000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380113ba8f3689210a5bc93fd55668e98df99f409207e5a1c5130fe579f98804
Instruction ID: 332efee254f33174a25f3cf0ebd32206d0ff9ddff62c65df652417247d292d06
Opcode Fuzzy Hash: 380113ba8f3689210a5bc93fd55668e98df99f409207e5a1c5130fe579f98804
Instruction Fuzzy Hash: 99F0D070E1E65ACEFB65DB25C8557B9BBF0AF46300F0044FAC00DA6591CF385A888F50

Function 00007FFAAC1E6518 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac1e0000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7d395904395ee03f9d1eae425f24ccbc63b12a25cb7ac93ebae309abe81f45
Instruction ID: a47d025eea5e3b3704b02f47e3e1ea1fa52fec002eb240e4b177ada07e5c64ac
Opcode Fuzzy Hash: aa7d395904395ee03f9d1eae425f24ccbc63b12a25cb7ac93ebae309abe81f45
Instruction Fuzzy Hash: 5EE04F31B19A198EF746F728404827A79D1DFD92A5F088A3AE40DE21A4DF24958886C6

Function 00007FFAAC182900 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb87e6e2818e86bc39935ff6e79701f7f5f0653d0e47934e89389a38e8dd1a5f
Instruction ID: fc456ac3e1453f27329e308e1197735e0bcfaca9c93e2fdcef8c45c3190b9a13
Opcode Fuzzy Hash: fb87e6e2818e86bc39935ff6e79701f7f5f0653d0e47934e89389a38e8dd1a5f
Instruction Fuzzy Hash: 57B01230C0C016CFEB518B64C00437D75B0AB29320F28003BD00DE3180CFAC84418F85

Function 00007FFAAC356028 Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1692184138.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac350000_ApplicationUrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39974cdae570005c693e9b2f443a8aa56a69fc48dd7599f3e0253625b6dc923
Instruction ID: b6fa1005de66e6aaacafedb7bda8ab17f7dac926e0b772e4c6433423cf23d5f3
Opcode Fuzzy Hash: a39974cdae570005c693e9b2f443a8aa56a69fc48dd7599f3e0253625b6dc923
Instruction Fuzzy Hash:

Non-executed Functions

Function 00007FFAAC1802CD Relevance: 7.6, Strings: 6, Instructions: 120COMMON

Download Yara Rule

Strings

H1e, xrefs: 00007FFAAC1802F9
(0e, xrefs: 00007FFAAC180379
-e, xrefs: 00007FFAAC180399
P/e, xrefs: 00007FFAAC180349
8,e, xrefs: 00007FFAAC180359
/e, xrefs: 00007FFAAC180319

Memory Dump Source

Source File: 00000004.00000002.1690449833.00007FFAAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac180000_ApplicationUrl.jbxd

Similarity

API ID:
String ID: (0e$8,e$H1e$P/e$-e$/e
API String ID: 0-1781137769
Opcode ID: 86361819bb2d626e0484dc1993765f0ff69a22359ed3d986bf1a7cd71495cb2a
Instruction ID: ca4f54807deee67b07a3b6018fa6130fc1a5bf89a3ebaab4c36464aabeb1f7b7
Opcode Fuzzy Hash: 86361819bb2d626e0484dc1993765f0ff69a22359ed3d986bf1a7cd71495cb2a
Instruction Fuzzy Hash: 31419053E4FAC58FF2538AD91865138AE94EF63640B18C0BBD58C4B5D7A945EA0DC3C2

Analysis Process: MSBuild.exePID: 4912, Parent PID: 4056COMMON

Executed Functions

Function 00007FFAAC1908D3 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

;M_^, xrefs: 00007FFAAC190901
K;M, xrefs: 00007FFAAC19096F

Memory Dump Source

Source File: 00000005.00000002.4001713265.00007FFAAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaac190000_MSBuild.jbxd

Similarity

API ID:
String ID: ;M_^$K;M
API String ID: 0-263230361
Opcode ID: 1ed13a863adf7d542e4ae8c4cc0074abe39a092e6549bb15cb00aeb0f9361797
Instruction ID: a8392c7bfb02ccbed5ed829caf7124af5efd951f5b8828174e1f7413c6ca0911
Opcode Fuzzy Hash: 1ed13a863adf7d542e4ae8c4cc0074abe39a092e6549bb15cb00aeb0f9361797
Instruction Fuzzy Hash: D2B11875A0992C8FDB94EF6CD895BECB7B1FF59311F0042AAD04DD7252CA35A885CB80

Function 00007FFAAC1908D8 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

;M_^, xrefs: 00007FFAAC190901
K;M, xrefs: 00007FFAAC19096F

Memory Dump Source

Source File: 00000005.00000002.4001713265.00007FFAAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaac190000_MSBuild.jbxd

Similarity

API ID:
String ID: ;M_^$K;M
API String ID: 0-263230361
Opcode ID: 5b8a9d7efa555380d9ca92a174c1a162f09528e4f2add20b3d84933ffa05ee7e
Instruction ID: c25f8d749771d28f6d5461ee48213a532cc7fb8edb0b0029ca0b4bcd8c6ca079
Opcode Fuzzy Hash: 5b8a9d7efa555380d9ca92a174c1a162f09528e4f2add20b3d84933ffa05ee7e
Instruction Fuzzy Hash: EAA13A71A0991C8FDB94EF6CD895BECB7B1FF59311F0042AAD04DE7252CA35A885CB80

Function 00007FFAAC1908E8 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

;M_^, xrefs: 00007FFAAC190901
K;M, xrefs: 00007FFAAC19096F

Memory Dump Source

Source File: 00000005.00000002.4001713265.00007FFAAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaac190000_MSBuild.jbxd

Similarity

API ID:
String ID: ;M_^$K;M
API String ID: 0-263230361
Opcode ID: 8e41e6c880a2d5030b1a0d34bd8d8735ad0fb521261101fd9ac1a8b3a6285561
Instruction ID: e911e138941d1b44da92918b3ec7450956c9e6c8e7c6f8f01da03c3ff6f5d06a
Opcode Fuzzy Hash: 8e41e6c880a2d5030b1a0d34bd8d8735ad0fb521261101fd9ac1a8b3a6285561
Instruction Fuzzy Hash: 67A12B71A0991C8FDB94EF6CD895BECB7B1FF59311F0042AAD04DE7252CA34A885CB80

Function 00007FFAAC1908F8 Relevance: 2.8, Strings: 2, Instructions: 311COMMON

Download Yara Rule

Strings

;M_^, xrefs: 00007FFAAC190901
K;M, xrefs: 00007FFAAC19096F

Memory Dump Source

Source File: 00000005.00000002.4001713265.00007FFAAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaac190000_MSBuild.jbxd

Similarity

API ID:
String ID: ;M_^$K;M
API String ID: 0-263230361
Opcode ID: a03254b9a1e24a9680917d03f8816bb4065ba2d071cf009d1751ed7a7a4e268b
Instruction ID: 7ba6f77131576a0b5dc7c497ba7c98e8b035f22cfb3e706fd6c5d9b5419e366b
Opcode Fuzzy Hash: a03254b9a1e24a9680917d03f8816bb4065ba2d071cf009d1751ed7a7a4e268b
Instruction Fuzzy Hash: 10A11971A0991D8FDB94EF6CD895BECB7B1FF59311F0042AAD04DE7252CA35A885CB80

Function 00007FFAAC1908C8 Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

K;M, xrefs: 00007FFAAC19096F

Memory Dump Source

Source File: 00000005.00000002.4001713265.00007FFAAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaac190000_MSBuild.jbxd

Similarity

API ID:
String ID: K;M
API String ID: 0-1666167106
Opcode ID: 3a342cfcdcf5696c80fba3273a7f857fc3ea0b9617057889b418f0ac7138ee6f
Instruction ID: 71a0f9609d5d8acc8b582a1c7047e3ba06505570cee3fffb9dfeabe713f88df7
Opcode Fuzzy Hash: 3a342cfcdcf5696c80fba3273a7f857fc3ea0b9617057889b418f0ac7138ee6f
Instruction Fuzzy Hash: E4A10A71A0991D8FDB94EF6CD895BECB7B1FF59311F1041AAD00DE7252CA35A885CB80

Function 00007FFAAC190CE5 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4001713265.00007FFAAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaac190000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d23c680249c6292569abcbcbfa60e7b5ff8aeee0757d9d29b59053f8088e0b4
Instruction ID: 529e7fc04f3c777139c7b2b148989e6d166053fd3d59b043ddf4f68ad499a44a
Opcode Fuzzy Hash: 1d23c680249c6292569abcbcbfa60e7b5ff8aeee0757d9d29b59053f8088e0b4
Instruction Fuzzy Hash: 5E41927151F7C99FE3428BB8845919A7FE0EF4B26070581FAD489CB26ADA6D1C47C710

Function 00007FFAAC1910F4 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4001713265.00007FFAAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaac190000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c75f6c97ee3f37b4277842e1d660e7fa03ac4ff92fcae6953cf1fbf90cc35d
Instruction ID: 4d9a72865d37a6363c4b27c592794af5fbcbe0095e18d6bea0e56e40fe1b00d2
Opcode Fuzzy Hash: 56c75f6c97ee3f37b4277842e1d660e7fa03ac4ff92fcae6953cf1fbf90cc35d
Instruction Fuzzy Hash: 7E31FBB0909A9D9FDB91EB68885D7DABBF1EF59311F5480EAD00DD7221DA385D82CF00

Function 00007FFAAC197CE1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4001713265.00007FFAAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaac190000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae84b1e42f1124826399a2a20b0fc6c6a3b425e5691bc684efb6e3d2500ee38
Instruction ID: f5cac3e135a69150f474c4d579cd0ad2c519fff8d21f581625d4d2e01261ab33
Opcode Fuzzy Hash: 2ae84b1e42f1124826399a2a20b0fc6c6a3b425e5691bc684efb6e3d2500ee38
Instruction Fuzzy Hash: C0F0F830D09A5CCFDF90DB68D844AACB7B0FF45314F0042AAD44DD7152DA31A995DB94

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PROFORMA FATURA pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\ApplicationUrl.exe

C:\Users\user\AppData\Roaming\ApplicationUrl.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
PROFORMA FATURA pdf.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre