Edit tour

Windows Analysis Report
7rtK9LWbTc.exe

Overview

General Information

Sample name:	7rtK9LWbTc.exe renamed because original name is a hash value
Original sample name:	1530387224130061e6087f1c57655891a251895e.exe
Analysis ID:	1546801
MD5:	d0930dc6939b931c258795a16b59c2cf
SHA1:	1530387224130061e6087f1c57655891a251895e
SHA256:	5cc4012aaf7b2da15f12a47279c9b5c634e8d2daf6e93dff0492cdbc73ba9e7d
Tags:	exeReversingLabsuser-NDA0E
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for dropped file

Machine Learning detection for sample

Self deletion via cmd or bat file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (may stop execution after checking a module file name)

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7rtK9LWbTc.exe (PID: 8056 cmdline: "C:\Users\user\Desktop\7rtK9LWbTc.exe" MD5: D0930DC6939B931C258795A16B59C2CF)

guifx.exe (PID: 8080 cmdline: "C:\ProgramData\Graphics\guifx.exe" /run MD5: A7D9795D178F27CA2CEBB45293CFE3B1)

cmd.exe (PID: 5804 cmdline: "C:\windows\system32\cmd.exe" /c del /q "C:\Users\user\Desktop\7rtK9LWbTc.exe" >> NUL MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

guifx.exe (PID: 7340 cmdline: "C:\ProgramData\Graphics\guifx.exe" /run MD5: A7D9795D178F27CA2CEBB45293CFE3B1)

guifx.exe (PID: 7804 cmdline: "C:\ProgramData\Graphics\guifx.exe" /run MD5: A7D9795D178F27CA2CEBB45293CFE3B1)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Graphics\guifx.exe" /run, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\7rtK9LWbTc.exe, ProcessId: 8056, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Graphics

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T15:56:43.995773+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.3	52231	TCP
2024-11-01T15:57:24.132928+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.3	56234	TCP

ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T15:56:25.946305+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49713	165.194.123.67	443	TCP
2024-11-01T15:56:25.984737+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49717	165.194.123.67	443	TCP
2024-11-01T15:56:25.986796+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49718	165.194.123.67	443	TCP
2024-11-01T15:56:25.994165+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49721	165.194.123.67	443	TCP
2024-11-01T15:56:26.015007+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49732	165.194.123.67	443	TCP
2024-11-01T15:56:26.018663+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49734	165.194.123.67	443	TCP
2024-11-01T15:56:26.023901+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49737	165.194.123.67	443	TCP
2024-11-01T15:56:26.033127+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49742	165.194.123.67	443	TCP
2024-11-01T15:56:26.039997+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49746	165.194.123.67	443	TCP
2024-11-01T15:56:26.044060+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	49748	165.194.123.67	443	TCP
2024-11-01T15:57:21.114817+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56131	165.194.123.67	443	TCP
2024-11-01T15:57:22.421563+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56300	165.194.123.67	443	TCP
2024-11-01T15:57:22.504054+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56344	165.194.123.67	443	TCP
2024-11-01T15:57:23.649361+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56421	165.194.123.67	443	TCP
2024-11-01T15:57:24.992918+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56597	165.194.123.67	443	TCP
2024-11-01T15:57:26.003800+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56607	165.194.123.67	443	TCP
2024-11-01T15:57:26.015716+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56614	165.194.123.67	443	TCP
2024-11-01T15:57:26.043493+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56628	165.194.123.67	443	TCP
2024-11-01T15:57:26.051501+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56631	165.194.123.67	443	TCP
2024-11-01T15:57:26.062831+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	56637	165.194.123.67	443	TCP
2024-11-01T15:58:13.367634+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	61379	165.194.123.67	443	TCP
2024-11-01T15:58:13.477389+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	61429	165.194.123.67	443	TCP
2024-11-01T15:58:14.610729+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	61480	165.194.123.67	443	TCP
2024-11-01T15:58:14.681179+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	61519	165.194.123.67	443	TCP
2024-11-01T15:58:16.092610+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	61619	165.194.123.67	443	TCP
2024-11-01T15:58:22.336559+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	62291	165.194.123.67	443	TCP
2024-11-01T15:58:26.572505+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	62621	165.194.123.67	443	TCP
2024-11-01T15:58:26.575036+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	62622	165.194.123.67	443	TCP
2024-11-01T15:58:26.603630+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	62636	165.194.123.67	443	TCP
2024-11-01T15:58:26.634937+0100	2824976	1	Malware Command and Control Activity Detected	192.168.2.3	62650	165.194.123.67	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7rtK9LWbTc.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ProgramData\Graphics\guifx.exe

Avira: detection malicious, Label: TR/Agent.fjnu

Multi AV Scanner detection for submitted file

Source: 7rtK9LWbTc.exe

ReversingLabs: Detection: 97%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Graphics\guifx.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7rtK9LWbTc.exe

Joe Sandbox ML: detected

Source: 7rtK9LWbTc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7rtK9LWbTc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\Data\My Projects\Troy Source Code\tcp1st\rifle\Release\rifle.pdb source: 7rtK9LWbTc.exe, guifx.exe.0.dr
Source:	Binary string: E:\Data\My Projects\Troy Source Code\tcp1st\rifle\Release\rifle.pdbA source: 7rtK9LWbTc.exe, guifx.exe.0.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49746 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49713 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49734 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49737 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49717 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49721 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49748 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49742 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49718 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:49732 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56628 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56631 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56607 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56637 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56344 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56131 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56614 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56421 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56300 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:56597 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:62621 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:61379 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:61429 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:62636 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:62650 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:61480 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:61519 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:62291 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:62622 -> 165.194.123.67:443
Source: Network traffic	Suricata IDS: 2824976 - Severity 1 - ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin : 192.168.2.3:61619 -> 165.194.123.67:443

Source: Joe Sandbox View

ASN Name: CAUNET-AS-KRChung-AngUniversityKR CAUNET-AS-KRChung-AngUniversityKR

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.3:52231
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.3:56234

Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67
Source: unknown	TCP traffic detected without corresponding DNS query: 165.194.123.67

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Code function: 0_2_00BC27E0 WSAStartup,Sleep,Sleep,recv,closesocket,Sleep,

0_2_00BC27E0

Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: http://sf.symcd.com0&
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: http://www.initech.com0
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 7rtK9LWbTc.exe, guifx.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0

Source: unknown	Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53844
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53841
Source: unknown	Network traffic detected: HTTP traffic on port 62496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 60675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53855
Source: unknown	Network traffic detected: HTTP traffic on port 62868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53852
Source: unknown	Network traffic detected: HTTP traffic on port 53910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown	Network traffic detected: HTTP traffic on port 57011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51209
Source: unknown	Network traffic detected: HTTP traffic on port 58348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53865
Source: unknown	Network traffic detected: HTTP traffic on port 54851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 59228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51218
Source: unknown	Network traffic detected: HTTP traffic on port 53922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53871
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51215
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53874
Source: unknown	Network traffic detected: HTTP traffic on port 52212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53880
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53805
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53800
Source: unknown	Network traffic detected: HTTP traffic on port 54838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53809
Source: unknown	Network traffic detected: HTTP traffic on port 62893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown	Network traffic detected: HTTP traffic on port 61976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53811
Source: unknown	Network traffic detected: HTTP traffic on port 61567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 53501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown	Network traffic detected: HTTP traffic on port 59649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53823
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53827
Source: unknown	Network traffic detected: HTTP traffic on port 55287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown	Network traffic detected: HTTP traffic on port 58312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53835
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53833
Source: unknown	Network traffic detected: HTTP traffic on port 53513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53832
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53830
Source: unknown	Network traffic detected: HTTP traffic on port 59241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51147
Source: unknown	Network traffic detected: HTTP traffic on port 56623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63129
Source: unknown	Network traffic detected: HTTP traffic on port 59637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 53598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63122
Source: unknown	Network traffic detected: HTTP traffic on port 60626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63125
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 54442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown	Network traffic detected: HTTP traffic on port 57456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63135
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63138
Source: unknown	Network traffic detected: HTTP traffic on port 56635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown	Network traffic detected: HTTP traffic on port 60638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63146
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63147
Source: unknown	Network traffic detected: HTTP traffic on port 59625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63162
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63164
Source: unknown	Network traffic detected: HTTP traffic on port 57444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51175
Source: unknown	Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 61195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51179
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63155
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63159
Source: unknown	Network traffic detected: HTTP traffic on port 53562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63158
Source: unknown	Network traffic detected: HTTP traffic on port 54454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51108
Source: unknown	Network traffic detected: HTTP traffic on port 56576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53769
Source: unknown	Network traffic detected: HTTP traffic on port 59601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown	Network traffic detected: HTTP traffic on port 54395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53761
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53760
Source: unknown	Network traffic detected: HTTP traffic on port 57420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown	Network traffic detected: HTTP traffic on port 61988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53770
Source: unknown	Network traffic detected: HTTP traffic on port 63376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown	Network traffic detected: HTTP traffic on port 56659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53776
Source: unknown	Network traffic detected: HTTP traffic on port 54466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51114
Source: unknown	Network traffic detected: HTTP traffic on port 53550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53775
Source: unknown	Network traffic detected: HTTP traffic on port 56564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53780
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53782
Source: unknown	Network traffic detected: HTTP traffic on port 57493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53787
Source: unknown	Network traffic detected: HTTP traffic on port 63388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63107
Source: unknown	Network traffic detected: HTTP traffic on port 50836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53791
Source: unknown	Network traffic detected: HTTP traffic on port 57432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63105
Source: unknown	Network traffic detected: HTTP traffic on port 54478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51133
Source: unknown	Network traffic detected: HTTP traffic on port 52694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53796
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53797
Source: unknown	Network traffic detected: HTTP traffic on port 60614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63118
Source: unknown	Network traffic detected: HTTP traffic on port 53549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63116
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51187
Source: unknown	Network traffic detected: HTTP traffic on port 63293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51193
Source: unknown	Network traffic detected: HTTP traffic on port 58385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51194

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Code function: 0_2_00BC12A0	0_2_00BC12A0
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Code function: 0_2_00BC10C0	0_2_00BC10C0
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Code function: 0_2_00BC1020	0_2_00BC1020
Source: C:\ProgramData\Graphics\guifx.exe	Code function: 1_2_00F712A0	1_2_00F712A0
Source: C:\ProgramData\Graphics\guifx.exe	Code function: 1_2_00F710C0	1_2_00F710C0
Source: C:\ProgramData\Graphics\guifx.exe	Code function: 1_2_00F71020	1_2_00F71020

Source: 7rtK9LWbTc.exe, 00000000.00000000.1405883459.0000000000BD4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInitech Client> vs 7rtK9LWbTc.exe
Source: 7rtK9LWbTc.exe, 00000000.00000002.1714258287.0000000002480000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInitech Client> vs 7rtK9LWbTc.exe
Source: 7rtK9LWbTc.exe, 00000000.00000002.1713818622.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmY vs 7rtK9LWbTc.exe
Source: 7rtK9LWbTc.exe	Binary or memory string: OriginalFilenameInitech Client> vs 7rtK9LWbTc.exe

Source: 7rtK9LWbTc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal92.evad.winEXE@8/2@0/1

Source: C:\ProgramData\Graphics\guifx.exe	Mutant created: \Sessions\1\BaseNamedObjects\MUTEX394039_4830023
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1796:120:WilError_03

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Command line argument: /run		0_2_00BC2C50
Source: C:\ProgramData\Graphics\guifx.exe	Command line argument: /run		1_2_00F72C50

Source: 7rtK9LWbTc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7rtK9LWbTc.exe

ReversingLabs: Detection: 97%

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

File read: C:\Users\user\Desktop\7rtK9LWbTc.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7rtK9LWbTc.exe "C:\Users\user\Desktop\7rtK9LWbTc.exe"
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Process created: C:\ProgramData\Graphics\guifx.exe "C:\ProgramData\Graphics\guifx.exe" /run
Source: unknown	Process created: C:\ProgramData\Graphics\guifx.exe "C:\ProgramData\Graphics\guifx.exe" /run
Source: unknown	Process created: C:\ProgramData\Graphics\guifx.exe "C:\ProgramData\Graphics\guifx.exe" /run
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\windows\system32\cmd.exe" /c del /q "C:\Users\user\Desktop\7rtK9LWbTc.exe" >> NUL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Process created: C:\ProgramData\Graphics\guifx.exe "C:\ProgramData\Graphics\guifx.exe" /run	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\windows\system32\cmd.exe" /c del /q "C:\Users\user\Desktop\7rtK9LWbTc.exe" >> NUL	Jump to behavior

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: virtdisk.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Graphics\guifx.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: 7rtK9LWbTc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 7rtK9LWbTc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 7rtK9LWbTc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 7rtK9LWbTc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 7rtK9LWbTc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 7rtK9LWbTc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 7rtK9LWbTc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 7rtK9LWbTc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Data\My Projects\Troy Source Code\tcp1st\rifle\Release\rifle.pdb source: 7rtK9LWbTc.exe, guifx.exe.0.dr
Source:	Binary string: E:\Data\My Projects\Troy Source Code\tcp1st\rifle\Release\rifle.pdbA source: 7rtK9LWbTc.exe, guifx.exe.0.dr

Source: 7rtK9LWbTc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 7rtK9LWbTc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 7rtK9LWbTc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 7rtK9LWbTc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 7rtK9LWbTc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Code function: 0_2_00BC8E5C LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00BC8E5C

Source: guifx.exe.0.dr	Static PE information: real checksum: 0x14886 should be: 0x2294b
Source: 7rtK9LWbTc.exe	Static PE information: real checksum: 0x14886 should be: 0x1da2f

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Code function: 0_2_00BC76E5 push ecx; ret		0_2_00BC76F8
Source: C:\ProgramData\Graphics\guifx.exe	Code function: 1_2_00F776E5 push ecx; ret		1_2_00F776F8

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

File created: C:\ProgramData\Graphics\guifx.exe

Jump to dropped file

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

File created: C:\ProgramData\Graphics\guifx.exe

Jump to dropped file

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Graphics			Jump to behavior
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Graphics			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Process created: "C:\windows\system32\cmd.exe" /c del /q "C:\Users\user\Desktop\7rtK9LWbTc.exe" >> NUL
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Process created: "C:\windows\system32\cmd.exe" /c del /q "C:\Users\user\Desktop\7rtK9LWbTc.exe" >> NUL			Jump to behavior

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_0-5643
Source: C:\ProgramData\Graphics\guifx.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_1-5653

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Code function: _malloc,_free,GetAdaptersInfo,HeapReAlloc,GetLastError,GetLastError,	0_2_00BC306D
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Code function: GetComputerNameA,_malloc,GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,_sprintf,_sprintf,_free,	0_2_00BC17E0
Source: C:\ProgramData\Graphics\guifx.exe	Code function: GetComputerNameA,_malloc,GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,_sprintf,_sprintf,_free,	1_2_00F717E0
Source: C:\ProgramData\Graphics\guifx.exe	Code function: _malloc,_free,GetAdaptersInfo,HeapReAlloc,GetLastError,GetLastError,	1_2_00F7306D

Source: C:\ProgramData\Graphics\guifx.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_1-6483
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-6501

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-5700
Source: C:\ProgramData\Graphics\guifx.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_1-5709

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: 7rtK9LWbTc.exe, 00000000.00000002.1713818622.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: guifx.exe, 00000001.00000002.2667057368.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\ProgramData\Graphics\guifx.exe

API call chain: ExitProcess graph end node

graph_1-5652

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Code function: 0_2_00BC2D39 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00BC2D39

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

0_2_00BC8E5C

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Code function: 0_2_00BC1B60 recv,WSAGetLastError,Sleep,GetProcessHeap,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_00BC1B60

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Code function: 0_2_00BC6E85 SetUnhandledExceptionFilter,	0_2_00BC6E85
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Code function: 0_2_00BC2D39 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BC2D39
Source: C:\Users\user\Desktop\7rtK9LWbTc.exe	Code function: 0_2_00BC4555 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BC4555
Source: C:\ProgramData\Graphics\guifx.exe	Code function: 1_2_00F76E85 SetUnhandledExceptionFilter,	1_2_00F76E85
Source: C:\ProgramData\Graphics\guifx.exe	Code function: 1_2_00F74555 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00F74555
Source: C:\ProgramData\Graphics\guifx.exe	Code function: 1_2_00F72D39 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00F72D39

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\windows\system32\cmd.exe" /c del /q "C:\Users\user\Desktop\7rtK9LWbTc.exe" >> NUL

Jump to behavior

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Code function: 0_2_00BC788F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00BC788F

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Code function: 0_2_00BC19A0 GetUserNameA,_sprintf,lstrlenA,WSAStartup,gethostname,gethostbyname,WSACleanup,

0_2_00BC19A0

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Code function: 0_2_00BC5E9B __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_00BC5E9B

Source: C:\Users\user\Desktop\7rtK9LWbTc.exe

Code function: 0_2_00BC1720 _memset,GetVersionExA,GetVersionExA,GetVersionExA,wsprintfA,

0_2_00BC1720

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Obfuscated Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
7rtK9LWbTc.exe	97%	ReversingLabs	Win32.Backdoor.Rifdoor
7rtK9LWbTc.exe	100%	Avira	TR/Agent.fjnu
7rtK9LWbTc.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Graphics\guifx.exe	100%	Avira	TR/Agent.fjnu
C:\ProgramData\Graphics\guifx.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.thawte.com/ThawteTimestampingCA.crl0	7rtK9LWbTc.exe, guifx.exe.0.dr	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	7rtK9LWbTc.exe, guifx.exe.0.dr	false	URL Reputation: safe	unknown
http://www.initech.com0	7rtK9LWbTc.exe, guifx.exe.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
165.194.123.67	unknown	Korea Republic of		17575	CAUNET-AS-KRChung-AngUniversityKR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546801
Start date and time:	2024-11-01 15:55:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7rtK9LWbTc.exe renamed because original name is a hash value
Original Sample Name:	1530387224130061e6087f1c57655891a251895e.exe
Detection:	MAL
Classification:	mal92.evad.winEXE@8/2@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 12 Number of non-executed functions: 43
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 7rtK9LWbTc.exe

Simulations

Behavior and APIs

Time	Type	Description
15:56:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Graphics "C:\ProgramData\Graphics\guifx.exe" /run
15:56:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Graphics "C:\ProgramData\Graphics\guifx.exe" /run

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
165.194.123.67	7D6J8VLSb0.exe	Get hash	malicious	Unknown	Browse
165.194.123.67	7D6J8VLSb0.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CAUNET-AS-KRChung-AngUniversityKR	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	165.195.252.222
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	165.194.55.87
	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	165.195.13.52
	botx.mips.elf	Get hash	malicious	Mirai	Browse	165.195.79.140
	xS8bwPQjO2.elf	Get hash	malicious	Mirai	Browse	165.195.32.143
	skt.sh4.elf	Get hash	malicious	Mirai	Browse	165.195.32.116
	7ALXuklmvu.elf	Get hash	malicious	Mirai	Browse	165.195.32.113
	gVPlpwuoVV.elf	Get hash	malicious	Mirai	Browse	165.195.79.193
	QXp14SFCPn.elf	Get hash	malicious	Mirai	Browse	165.195.32.158
	JiD2VwpPLD.elf	Get hash	malicious	Mirai	Browse	165.195.32.134

Process:	C:\Users\user\Desktop\7rtK9LWbTc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80316
Entropy (8bit):	6.297467049156134
Encrypted:	false
SSDEEP:	1536:nLNIW39SaZTbFARlq7jC1OZstZu0TS3gEdUJCkb0FG5q:nLlbZTZX3BAtTS3gEdUJCkb0FGg
MD5:	A7D9795D178F27CA2CEBB45293CFE3B1
SHA1:	F062645E17ED744D6F37A88789F202069FCD2F2A
SHA-256:	07269DDD0AA2A800C1C7A501D9B6ED5A09B743B8A54B1DA2237BAFA232A0DEAA
SHA-512:	D5759D3B05873B6FA1FDD62BF339965EE217B4FE19D585AD3955E8D3FD437C6E8E1D8BF3411E7011A75B59FA1C33FA5F704D5A48C76DEB07563067825A82F479
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K.mSK.mSK.mS$..Si.mS$..SY.mS$..S-.mSB..SX.mSK.lS5.mS$..SJ.mS$..SJ.mS$..SJ.mSRichK.mS........................PE..L...P..V.....................h.......6............@..........................p.......H....@..........................................@.......................P......0...................................@............................................text............................... ..`.rdata..P4.......6..................@..@.data...`2..........................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	4.580023372597454
Encrypted:	false
SSDEEP:	3:oNWXp5vSX/ocNyn:oNWXpFSXQcNyn
MD5:	E6FFABCE93BB1A121A9D82AFD3CD57E4
SHA1:	07BA6A65DC0B128CD744AB19AFE924A69095D310
SHA-256:	2F22B6C9ADC737C0FB9DC896111E512633A04F398DFA91539984830A584E7022
SHA-512:	6F7BA36D90588946BE74E4FEE0522DF79A01D764AC7EE3E0E0D084AAF1D2CFE618C2530BFC46CE50D5B9D4CAE99193C2E9CCB3BD4525B7F0A703A574C3644B63
Malicious:	false
Reputation:	low
Preview:	C:\Users\user\Desktop\7rtK9LWbTc.exe..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.29738403146313
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7rtK9LWbTc.exe
File size:	80'312 bytes
MD5:	d0930dc6939b931c258795a16b59c2cf
SHA1:	1530387224130061e6087f1c57655891a251895e
SHA256:	5cc4012aaf7b2da15f12a47279c9b5c634e8d2daf6e93dff0492cdbc73ba9e7d
SHA512:	6fbd17985aeaf6f1280f3b12a8ac84886f923e93edf876c4081de900e39153843a56e73622e974e812901afec3834eca98f71ef2b6caa0d42f8049d2f6c66cd1
SSDEEP:	1536:nLNIW39SaZTbFARlq7jC1OZstZu0TS3gEdUJCkb0FG5K:nLlbZTZX3BAtTS3gEdUJCkb0FGQ
TLSH:	46738E127290C833E5A2193544B9D7B28A7EBD3376F8D887779407EA1E703D06A3931B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K.mSK.mSK.mS$..Si.mS$..SY.mS$..S-.mSB..SX.mSK.lS5.mS$..SJ.mS$..SJ.mS$..SJ.mSRichK.mS........................PE..L...P..V...

File Icon


Icon Hash:	0779608eb2ceca2b

Static PE Info

General

Entrypoint:	0x40367f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x56AC0450 [Sat Jan 30 00:31:12 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	587bf55eb237bb0ee3c9d753b5b27e23

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F2A84902E70h
jmp 00007F2A848FEAEEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004110A8h], eax
mov dword ptr [004110A4h], ecx
mov dword ptr [004110A0h], edx
mov dword ptr [0041109Ch], ebx
mov dword ptr [00411098h], esi
mov dword ptr [00411094h], edi
mov word ptr [004110C0h], ss
mov word ptr [004110B4h], cs
mov word ptr [00411090h], ds
mov word ptr [0041108Ch], es
mov word ptr [00411088h], fs
mov word ptr [00411084h], gs
pushfd
pop dword ptr [004110B8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004110ACh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004110B0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004110BCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00410FF8h], 00010001h
mov eax, dword ptr [004110B0h]
mov dword ptr [00410FACh], eax
mov dword ptr [00410FA0h], C0000409h
mov dword ptr [00410FA4h], 00000001h
mov eax, dword ptr [0041003Ch]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00410040h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [00000000h]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xea0c	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0xbf4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11a00	0x1900
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15000	0xaf0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc230	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe4f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x1f0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xac08	0xae00	234eb5dbcff2f9e86366963f4b4e54b4	False	0.6091954022988506	data	6.532570610424447	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x3450	0x3600	2ec05c3954f5ff17a59c2bcd65341562	False	0.35886863425925924	data	5.048972656075167	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x10000	0x3260	0x1000	c1c740263560700f4483e80e3b6f81f7	False	0.211181640625	data	2.365191135288967	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14000	0xbf4	0xc00	f0991e45f8fec6f15ded02b513e73c4e	False	0.3388671875	data	3.9099047812976093	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15000	0x1506	0x1600	9b3cced7d78100d22773bc775f9d126e	False	0.4266690340909091	data	4.173697033961006	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x14130	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256	English	United States	0.2434971098265896
RT_GROUP_ICON	0x14698	0x14	data	English	United States	1.1
RT_VERSION	0x146ac	0x2e8	data	English	United States	0.43951612903225806
RT_MANIFEST	0x14994	0x25f	ASCII text, with very long lines (607), with no line terminators	English	United States	0.43492586490939045

Imports

DLL	Import
SHLWAPI.dll	StrToIntA, StrChrA, StrStrA
WS2_32.dll	connect, WSAStartup, gethostname, WSAIoctl, htons, setsockopt, WSACleanup, recv, socket, closesocket, gethostbyname, send, WSAGetLastError
WININET.dll	DeleteUrlCacheEntry
ADVAPI32.dll	RegCloseKey, GetUserNameA, RegOpenKeyExA, RegCreateKeyA, RegQueryValueExA, RegSetValueExA
urlmon.dll	URLOpenBlockingStreamA
SHELL32.dll	ShellExecuteA
USER32.dll	wsprintfA
IPHLPAPI.DLL	GetAdaptersInfo
KERNEL32.dll	IsProcessorFeaturePresent, GetStringTypeW, LoadLibraryW, HeapSize, RtlUnwind, SetStdHandle, WriteConsoleW, CreateFileW, FlushFileBuffers, CompareStringW, SetEnvironmentVariableA, LeaveCriticalSection, EnterCriticalSection, GetConsoleMode, GetConsoleCP, SetFilePointer, HeapReAlloc, ExitProcess, GetComputerNameA, CreateFileA, GetFileSize, lstrcmpA, lstrlenA, HeapAlloc, HeapFree, WaitForSingleObject, GetTickCount, GetProcessHeap, WriteFile, GetCommandLineA, GlobalAlloc, Sleep, GetExitCodeProcess, CreateProcessA, TerminateProcess, ReadFile, lstrcatA, CreateDirectoryA, SetCurrentDirectoryA, GetLastError, OpenMutexA, CreatePipe, GetModuleFileNameA, CreateMutexA, GetVersionExA, WinExec, CloseHandle, GetTempPathA, lstrcpyA, GetSystemTimeAsFileTime, HeapSetInformation, GetStartupInfoW, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, DecodePointer, EncodePointer, HeapCreate, GetProcAddress, GetModuleHandleW, GetStdHandle, GetModuleFileNameW, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, WideCharToMultiByte, LCMapStringW, MultiByteToWideChar, GetTimeZoneInformation, RaiseException, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetCurrentProcessId

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T15:56:25.946305+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49713	165.194.123.67	443	TCP
2024-11-01T15:56:25.984737+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49717	165.194.123.67	443	TCP
2024-11-01T15:56:25.986796+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49718	165.194.123.67	443	TCP
2024-11-01T15:56:25.994165+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49721	165.194.123.67	443	TCP
2024-11-01T15:56:26.015007+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49732	165.194.123.67	443	TCP
2024-11-01T15:56:26.018663+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49734	165.194.123.67	443	TCP
2024-11-01T15:56:26.023901+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49737	165.194.123.67	443	TCP
2024-11-01T15:56:26.033127+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49742	165.194.123.67	443	TCP
2024-11-01T15:56:26.039997+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49746	165.194.123.67	443	TCP
2024-11-01T15:56:26.044060+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	49748	165.194.123.67	443	TCP
2024-11-01T15:56:43.995773+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.3	52231	TCP
2024-11-01T15:57:21.114817+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56131	165.194.123.67	443	TCP
2024-11-01T15:57:22.421563+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56300	165.194.123.67	443	TCP
2024-11-01T15:57:22.504054+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56344	165.194.123.67	443	TCP
2024-11-01T15:57:23.649361+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56421	165.194.123.67	443	TCP
2024-11-01T15:57:24.132928+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.3	56234	TCP
2024-11-01T15:57:24.992918+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56597	165.194.123.67	443	TCP
2024-11-01T15:57:26.003800+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56607	165.194.123.67	443	TCP
2024-11-01T15:57:26.015716+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56614	165.194.123.67	443	TCP
2024-11-01T15:57:26.043493+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56628	165.194.123.67	443	TCP
2024-11-01T15:57:26.051501+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56631	165.194.123.67	443	TCP
2024-11-01T15:57:26.062831+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	56637	165.194.123.67	443	TCP
2024-11-01T15:58:13.367634+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	61379	165.194.123.67	443	TCP
2024-11-01T15:58:13.477389+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	61429	165.194.123.67	443	TCP
2024-11-01T15:58:14.610729+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	61480	165.194.123.67	443	TCP
2024-11-01T15:58:14.681179+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	61519	165.194.123.67	443	TCP
2024-11-01T15:58:16.092610+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	61619	165.194.123.67	443	TCP
2024-11-01T15:58:22.336559+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	62291	165.194.123.67	443	TCP
2024-11-01T15:58:26.572505+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	62621	165.194.123.67	443	TCP
2024-11-01T15:58:26.575036+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	62622	165.194.123.67	443	TCP
2024-11-01T15:58:26.603630+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	62636	165.194.123.67	443	TCP
2024-11-01T15:58:26.634937+0100	2824976	ETPRO MALWARE Lazarus Rifle/Agent.RTC Checkin	1	192.168.2.3	62650	165.194.123.67	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 15:56:25.918521881 CET	49709	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.918570042 CET	443	49709	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.918694019 CET	49709	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.924536943 CET	49709	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.924552917 CET	443	49709	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.924629927 CET	443	49709	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.925175905 CET	49710	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.925229073 CET	443	49710	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.925556898 CET	49710	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.927565098 CET	49710	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.927587986 CET	443	49710	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.927614927 CET	443	49710	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.928045988 CET	49711	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.928066015 CET	443	49711	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.928237915 CET	49711	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.931265116 CET	49711	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.931273937 CET	443	49711	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.931320906 CET	443	49711	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.931581974 CET	49712	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.931621075 CET	443	49712	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.931781054 CET	49712	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.938544035 CET	49712	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.938558102 CET	443	49712	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.938591957 CET	443	49712	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.938848972 CET	49713	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.938889980 CET	443	49713	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.939013004 CET	49713	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.946305037 CET	49713	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.946321964 CET	443	49713	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.946357965 CET	443	49713	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.946707010 CET	49714	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.946738958 CET	443	49714	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.946826935 CET	49714	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.949321985 CET	49714	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.949333906 CET	443	49714	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.949369907 CET	443	49714	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.949740887 CET	49715	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.949774981 CET	443	49715	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.949924946 CET	49715	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.979332924 CET	49715	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.979346991 CET	443	49715	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.979427099 CET	443	49715	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.980020046 CET	49716	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.980043888 CET	443	49716	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.980237007 CET	49716	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.982386112 CET	49716	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.982398987 CET	443	49716	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.982429028 CET	443	49716	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.982733965 CET	49717	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.982781887 CET	443	49717	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.982896090 CET	49717	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.984736919 CET	49717	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.984752893 CET	443	49717	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.984777927 CET	443	49717	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.985043049 CET	49718	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.985055923 CET	443	49718	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.985130072 CET	49718	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.986795902 CET	49718	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.986807108 CET	443	49718	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.986834049 CET	443	49718	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.987102985 CET	49719	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.987118959 CET	443	49719	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.987627029 CET	49719	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.989989042 CET	49719	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.990004063 CET	443	49719	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.990026951 CET	443	49719	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.990325928 CET	49720	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.990361929 CET	443	49720	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.990665913 CET	49720	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.992141008 CET	49720	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.992157936 CET	443	49720	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.992178917 CET	443	49720	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.992436886 CET	49721	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.992470026 CET	443	49721	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.992541075 CET	49721	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.994164944 CET	49721	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.994182110 CET	443	49721	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.994201899 CET	443	49721	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.994688988 CET	49722	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.994699955 CET	443	49722	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.994777918 CET	49722	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.996228933 CET	49722	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.996241093 CET	443	49722	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.996262074 CET	443	49722	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.996541023 CET	49723	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.996551991 CET	443	49723	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.996632099 CET	49723	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.998011112 CET	49723	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.998023033 CET	443	49723	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.998042107 CET	443	49723	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.998332024 CET	49724	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.998375893 CET	443	49724	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.998456001 CET	49724	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.999885082 CET	49724	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:25.999907017 CET	443	49724	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:25.999928951 CET	443	49724	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.000164032 CET	49725	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.000185966 CET	443	49725	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.000322104 CET	49725	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.001678944 CET	49725	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.001693010 CET	443	49725	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.001719952 CET	443	49725	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.001966000 CET	49726	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.001986980 CET	443	49726	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.002080917 CET	49726	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.003567934 CET	49726	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.003582954 CET	443	49726	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.003607035 CET	443	49726	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.003912926 CET	49727	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.003921986 CET	443	49727	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.003985882 CET	49727	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.005850077 CET	49727	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.005865097 CET	443	49727	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.005887032 CET	443	49727	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.006131887 CET	49728	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.006140947 CET	443	49728	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.006237030 CET	49728	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.007658958 CET	49728	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.007669926 CET	443	49728	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.007694960 CET	443	49728	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.007952929 CET	49729	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.007966995 CET	443	49729	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.008173943 CET	49729	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.009429932 CET	49729	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.009443045 CET	443	49729	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.009464979 CET	443	49729	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.009706020 CET	49730	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.009720087 CET	443	49730	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.009793997 CET	49730	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.011301994 CET	49730	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.011318922 CET	443	49730	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.011349916 CET	443	49730	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.011585951 CET	49731	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.011599064 CET	443	49731	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.012938976 CET	49731	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.013164043 CET	49731	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.013176918 CET	443	49731	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.013212919 CET	443	49731	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.013480902 CET	49732	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.013509989 CET	443	49732	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.013576031 CET	49732	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.015007019 CET	49732	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.015022993 CET	443	49732	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.015052080 CET	443	49732	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.015289068 CET	49733	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.015324116 CET	443	49733	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.015387058 CET	49733	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.016819954 CET	49733	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.016833067 CET	443	49733	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.016854048 CET	443	49733	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.017095089 CET	49734	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.017107964 CET	443	49734	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.018662930 CET	49734	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.018662930 CET	49734	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.018688917 CET	443	49734	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.018734932 CET	443	49734	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.018964052 CET	49735	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.018980026 CET	443	49735	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.019043922 CET	49735	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.020412922 CET	49735	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.020428896 CET	443	49735	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.020453930 CET	443	49735	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.020682096 CET	49736	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.020713091 CET	443	49736	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.020776033 CET	49736	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.022150993 CET	49736	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.022166967 CET	443	49736	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.022193909 CET	443	49736	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.022408009 CET	49737	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.022444010 CET	443	49737	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.022507906 CET	49737	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.023900986 CET	49737	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.023920059 CET	443	49737	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.023941994 CET	443	49737	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.024197102 CET	49738	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.024214029 CET	443	49738	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.024271011 CET	49738	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.025798082 CET	49738	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.025814056 CET	443	49738	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.025836945 CET	443	49738	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.026242971 CET	49739	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.026252985 CET	443	49739	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.026310921 CET	49739	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.027755976 CET	49739	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.027767897 CET	443	49739	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.027795076 CET	443	49739	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.028027058 CET	49740	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.028059959 CET	443	49740	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.028121948 CET	49740	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.029572010 CET	49740	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.029583931 CET	443	49740	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.029608965 CET	443	49740	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.029839039 CET	49741	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.029858112 CET	443	49741	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.029915094 CET	49741	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.031287909 CET	49741	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.031302929 CET	443	49741	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.031358957 CET	443	49741	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.031590939 CET	49742	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.031605005 CET	443	49742	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.031667948 CET	49742	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.033127069 CET	49742	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.033142090 CET	443	49742	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.033164978 CET	443	49742	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.033380032 CET	49743	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.033389091 CET	443	49743	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.033446074 CET	49743	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.034842968 CET	49743	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.034851074 CET	443	49743	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.034883022 CET	443	49743	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.035115957 CET	49744	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.035125971 CET	443	49744	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.035187960 CET	49744	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.036540985 CET	49744	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.036552906 CET	443	49744	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.036580086 CET	443	49744	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.036798000 CET	49745	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.036823034 CET	443	49745	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.036885977 CET	49745	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.038310051 CET	49745	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.038322926 CET	443	49745	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.038343906 CET	443	49745	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.038567066 CET	49746	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.038579941 CET	443	49746	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.038640976 CET	49746	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.039997101 CET	49746	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.040008068 CET	443	49746	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.040033102 CET	443	49746	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.040255070 CET	49747	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.040266991 CET	443	49747	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.040328026 CET	49747	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.042004108 CET	49747	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.042017937 CET	443	49747	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.042037964 CET	443	49747	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.042303085 CET	49748	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.042314053 CET	443	49748	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.042387962 CET	49748	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.044059992 CET	49748	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.044071913 CET	443	49748	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.044095993 CET	443	49748	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.044359922 CET	49749	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.044378996 CET	443	49749	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.044441938 CET	49749	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.045999050 CET	49749	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.046013117 CET	443	49749	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.046036959 CET	443	49749	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.046287060 CET	49750	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.046302080 CET	443	49750	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.046370983 CET	49750	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.047820091 CET	49750	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.047832966 CET	443	49750	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.047857046 CET	443	49750	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.048079967 CET	49751	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.048091888 CET	443	49751	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.048151970 CET	49751	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.049537897 CET	49751	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.049550056 CET	443	49751	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.049570084 CET	443	49751	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.049808979 CET	49752	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.049830914 CET	443	49752	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.049900055 CET	49752	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.051309109 CET	49752	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.051327944 CET	443	49752	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.051351070 CET	443	49752	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.051578999 CET	49753	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.051603079 CET	443	49753	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.051692963 CET	49753	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.053019047 CET	49753	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.053031921 CET	443	49753	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.053056955 CET	443	49753	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.053325891 CET	49754	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.053340912 CET	443	49754	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.053433895 CET	49754	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.054857969 CET	49754	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.054872990 CET	443	49754	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.054894924 CET	443	49754	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.055130959 CET	49755	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.055140018 CET	443	49755	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.055222988 CET	49755	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.056611061 CET	49755	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.056617975 CET	443	49755	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.056636095 CET	443	49755	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.056936979 CET	49756	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.056955099 CET	443	49756	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.057020903 CET	49756	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.058558941 CET	49756	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.058573008 CET	443	49756	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.058594942 CET	443	49756	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.059036016 CET	49757	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.059052944 CET	443	49757	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.059195995 CET	49757	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.060602903 CET	49757	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.060616970 CET	443	49757	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.060637951 CET	443	49757	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.060873985 CET	49758	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.060883045 CET	443	49758	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.060944080 CET	49758	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.062355995 CET	49758	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.062370062 CET	443	49758	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.062390089 CET	443	49758	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.062630892 CET	49759	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.062639952 CET	443	49759	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.062712908 CET	49759	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.064078093 CET	49759	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.064088106 CET	443	49759	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.064110994 CET	443	49759	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.064337969 CET	49760	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.064356089 CET	443	49760	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.064893007 CET	49760	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.065829039 CET	49760	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.065848112 CET	443	49760	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.065870047 CET	443	49760	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.066093922 CET	49761	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.066108942 CET	443	49761	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.066210985 CET	49761	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.067549944 CET	49761	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.067564964 CET	443	49761	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.067584038 CET	443	49761	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.067804098 CET	49762	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.067812920 CET	443	49762	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.067903042 CET	49762	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.069263935 CET	49762	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.069276094 CET	443	49762	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.069298029 CET	443	49762	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.069528103 CET	49763	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.069536924 CET	443	49763	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.069598913 CET	49763	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.071014881 CET	49763	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.071026087 CET	443	49763	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.071043968 CET	443	49763	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.071268082 CET	49764	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.071295977 CET	443	49764	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.071361065 CET	49764	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.072864056 CET	49764	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.072876930 CET	443	49764	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.072902918 CET	443	49764	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.073174953 CET	49765	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.073185921 CET	443	49765	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.073247910 CET	49765	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.074676991 CET	49765	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.074692965 CET	443	49765	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.074713945 CET	443	49765	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.074949980 CET	49766	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.074959040 CET	443	49766	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.075016975 CET	49766	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.076447964 CET	49766	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.076458931 CET	443	49766	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.076484919 CET	443	49766	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.076723099 CET	49767	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.076731920 CET	443	49767	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.076792002 CET	49767	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.078161001 CET	49767	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.078175068 CET	443	49767	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.078193903 CET	443	49767	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.078443050 CET	49768	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.078453064 CET	443	49768	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.078586102 CET	49768	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.084673882 CET	49768	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.084686041 CET	443	49768	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.084717035 CET	443	49768	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.085133076 CET	49769	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.085153103 CET	443	49769	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.085220098 CET	49769	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.087132931 CET	49769	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.087147951 CET	443	49769	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.087182045 CET	443	49769	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.087486029 CET	49770	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.087496996 CET	443	49770	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.087589025 CET	49770	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.089198112 CET	49770	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.089210987 CET	443	49770	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.089237928 CET	443	49770	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.089534998 CET	49771	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.089549065 CET	443	49771	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.089631081 CET	49771	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.091125965 CET	49771	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.091139078 CET	443	49771	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.091161013 CET	443	49771	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.091397047 CET	49772	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.091425896 CET	443	49772	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.091494083 CET	49772	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.092983961 CET	49772	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.092998981 CET	443	49772	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.093020916 CET	443	49772	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.093257904 CET	49773	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.093274117 CET	443	49773	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.093362093 CET	49773	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.094790936 CET	49773	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.094808102 CET	443	49773	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.094831944 CET	443	49773	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.095069885 CET	49774	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.095083952 CET	443	49774	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.095149994 CET	49774	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.096600056 CET	49774	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.096616030 CET	443	49774	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.096637964 CET	443	49774	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.096874952 CET	49775	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.096889019 CET	443	49775	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.097084045 CET	49775	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.098479986 CET	49775	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.098494053 CET	443	49775	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.098519087 CET	443	49775	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.098808050 CET	49776	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.098819971 CET	443	49776	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.098886013 CET	49776	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.100305080 CET	49776	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.100317955 CET	443	49776	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.100344896 CET	443	49776	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.100586891 CET	49777	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.100600004 CET	443	49777	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.100661039 CET	49777	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.102132082 CET	49777	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.102144003 CET	443	49777	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.102168083 CET	443	49777	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.102473021 CET	49778	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.102482080 CET	443	49778	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.102554083 CET	49778	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.104007006 CET	49778	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.104018927 CET	443	49778	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.104041100 CET	443	49778	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.104270935 CET	49779	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.104281902 CET	443	49779	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.104355097 CET	49779	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.105778933 CET	49779	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.105791092 CET	443	49779	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.105812073 CET	443	49779	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.106081009 CET	49780	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.106096983 CET	443	49780	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.106157064 CET	49780	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.107726097 CET	49780	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.107738972 CET	443	49780	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.107763052 CET	443	49780	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.108020067 CET	49781	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.108042955 CET	443	49781	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.108094931 CET	49781	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.109596968 CET	49781	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.109611988 CET	443	49781	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.109630108 CET	443	49781	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.109889984 CET	49782	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.109901905 CET	443	49782	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.109982014 CET	49782	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.111840963 CET	49782	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.111854076 CET	443	49782	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.111872911 CET	443	49782	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.112169981 CET	49783	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.112199068 CET	443	49783	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.112258911 CET	49783	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.113862991 CET	49783	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.113878012 CET	443	49783	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.113898993 CET	443	49783	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.114167929 CET	49784	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.114200115 CET	443	49784	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.114279032 CET	49784	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.115772009 CET	49784	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.115787029 CET	443	49784	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.115806103 CET	443	49784	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.116028070 CET	49785	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.116039991 CET	443	49785	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.116107941 CET	49785	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.117556095 CET	49785	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.117567062 CET	443	49785	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.117590904 CET	443	49785	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.117847919 CET	49786	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.117857933 CET	443	49786	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.117917061 CET	49786	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.119513035 CET	49786	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.119525909 CET	443	49786	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.119544983 CET	443	49786	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.119784117 CET	49787	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.119792938 CET	443	49787	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.119839907 CET	49787	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.121316910 CET	49787	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.121329069 CET	443	49787	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.121351004 CET	443	49787	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.121578932 CET	49788	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.121596098 CET	443	49788	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.121646881 CET	49788	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.123083115 CET	49788	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.123095036 CET	443	49788	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.123116016 CET	443	49788	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.123336077 CET	49789	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.123347998 CET	443	49789	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.123403072 CET	49789	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.124828100 CET	49789	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.124840021 CET	443	49789	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.124865055 CET	443	49789	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.125143051 CET	49790	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.125154018 CET	443	49790	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.125211954 CET	49790	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.126655102 CET	49790	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.126666069 CET	443	49790	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.126687050 CET	443	49790	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.126913071 CET	49791	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.126921892 CET	443	49791	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.126980066 CET	49791	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.128622055 CET	49791	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.128633022 CET	443	49791	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.128660917 CET	443	49791	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.128936052 CET	49792	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.128953934 CET	443	49792	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.129010916 CET	49792	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.130522966 CET	49792	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.130537033 CET	443	49792	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.130558968 CET	443	49792	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.130842924 CET	49793	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.130857944 CET	443	49793	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.130929947 CET	49793	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.132492065 CET	49793	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.132502079 CET	443	49793	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.132524014 CET	443	49793	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.132863998 CET	49794	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.132875919 CET	443	49794	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.132929087 CET	49794	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.134474993 CET	49794	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.134486914 CET	443	49794	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.134505033 CET	443	49794	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.134732962 CET	49795	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.134742022 CET	443	49795	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.134799004 CET	49795	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.136328936 CET	49795	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.136338949 CET	443	49795	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.136360884 CET	443	49795	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.136637926 CET	49796	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.136651039 CET	443	49796	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.136706114 CET	49796	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.138186932 CET	49796	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.138199091 CET	443	49796	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.138220072 CET	443	49796	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.138425112 CET	49797	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.138441086 CET	443	49797	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.138494968 CET	49797	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.139946938 CET	49797	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.139961958 CET	443	49797	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.139995098 CET	443	49797	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.140244007 CET	49798	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.140275002 CET	443	49798	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.140327930 CET	49798	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.141801119 CET	49798	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.141813993 CET	443	49798	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.141836882 CET	443	49798	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.142038107 CET	49799	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.142049074 CET	443	49799	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.142105103 CET	49799	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.143917084 CET	49799	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.143929005 CET	443	49799	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.143954039 CET	443	49799	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.144251108 CET	49800	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.144282103 CET	443	49800	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.144354105 CET	49800	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.145880938 CET	49800	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.145899057 CET	443	49800	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.145917892 CET	443	49800	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.146146059 CET	49801	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.146173954 CET	443	49801	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.146274090 CET	49801	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.147708893 CET	49801	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.147723913 CET	443	49801	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.147747993 CET	443	49801	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.148101091 CET	49802	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.148113012 CET	443	49802	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.148199081 CET	49802	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.149801016 CET	49802	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.149812937 CET	443	49802	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.149832010 CET	443	49802	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.150084972 CET	49803	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.150095940 CET	443	49803	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.150199890 CET	49803	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.151669979 CET	49803	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.151680946 CET	443	49803	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.151705980 CET	443	49803	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.151962042 CET	49804	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.151987076 CET	443	49804	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.152060986 CET	49804	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.153898954 CET	49804	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.153912067 CET	443	49804	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.153932095 CET	443	49804	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.154150963 CET	49805	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.154180050 CET	443	49805	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.154228926 CET	49805	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.155719042 CET	49805	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.155733109 CET	443	49805	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.155755043 CET	443	49805	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.155999899 CET	49806	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.156009912 CET	443	49806	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.156079054 CET	49806	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.157608032 CET	49806	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.157620907 CET	443	49806	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.157641888 CET	443	49806	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.157849073 CET	49807	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.157860994 CET	443	49807	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.157912970 CET	49807	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.159404039 CET	49807	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.159431934 CET	443	49807	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.159451962 CET	443	49807	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.159734964 CET	49808	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.159744978 CET	443	49808	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.159799099 CET	49808	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.161263943 CET	49808	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.161278009 CET	443	49808	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.161300898 CET	443	49808	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.161578894 CET	49809	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.161591053 CET	443	49809	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.161701918 CET	49809	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.163283110 CET	49809	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.163295984 CET	443	49809	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.163328886 CET	443	49809	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.163563967 CET	49810	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.163574934 CET	443	49810	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.163629055 CET	49810	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.165085077 CET	49810	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.165097952 CET	443	49810	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.165118933 CET	443	49810	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.165672064 CET	49811	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.165683031 CET	443	49811	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.165769100 CET	49811	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.167700052 CET	49811	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.167712927 CET	443	49811	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.167731047 CET	443	49811	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.167965889 CET	49812	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.167975903 CET	443	49812	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.168026924 CET	49812	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.169523954 CET	49812	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.169538021 CET	443	49812	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.169558048 CET	443	49812	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.169785023 CET	49813	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.169797897 CET	443	49813	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.169866085 CET	49813	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.171288013 CET	49813	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.171299934 CET	443	49813	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.171338081 CET	443	49813	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.171567917 CET	49814	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.171580076 CET	443	49814	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.171655893 CET	49814	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.173099995 CET	49814	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.173115969 CET	443	49814	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.173136950 CET	443	49814	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.173356056 CET	49815	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.173366070 CET	443	49815	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.173423052 CET	49815	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.174874067 CET	49815	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.174886942 CET	443	49815	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.174906015 CET	443	49815	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.175128937 CET	49816	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.175179958 CET	443	49816	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.175232887 CET	49816	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.176644087 CET	49816	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.176661015 CET	443	49816	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.176683903 CET	443	49816	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.176898003 CET	49817	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.176924944 CET	443	49817	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.176979065 CET	49817	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.178774118 CET	49817	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.178787947 CET	443	49817	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.178808928 CET	443	49817	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.179032087 CET	49818	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.179044962 CET	443	49818	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.179097891 CET	49818	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.180497885 CET	49818	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.180510044 CET	443	49818	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.180536985 CET	443	49818	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.180740118 CET	49819	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.180749893 CET	443	49819	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.180809021 CET	49819	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.182284117 CET	49819	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.182296991 CET	443	49819	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.182318926 CET	443	49819	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.182569981 CET	49820	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.182586908 CET	443	49820	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.182636023 CET	49820	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.184463024 CET	49820	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.184475899 CET	443	49820	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.184500933 CET	443	49820	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.184736967 CET	49821	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.184753895 CET	443	49821	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.184814930 CET	49821	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.186299086 CET	49821	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.186312914 CET	443	49821	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.186336040 CET	443	49821	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.186572075 CET	49822	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.186579943 CET	443	49822	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.186639071 CET	49822	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.188313007 CET	49822	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.188323975 CET	443	49822	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.188349962 CET	443	49822	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.188574076 CET	49823	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.188590050 CET	443	49823	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.188643932 CET	49823	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.190140009 CET	49823	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.190159082 CET	443	49823	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.190177917 CET	443	49823	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.190713882 CET	49824	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.190740108 CET	443	49824	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.190862894 CET	49824	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.192327023 CET	49824	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.192338943 CET	443	49824	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.192363024 CET	443	49824	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.192671061 CET	49825	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.192684889 CET	443	49825	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.192758083 CET	49825	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.194202900 CET	49825	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.194216967 CET	443	49825	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.194238901 CET	443	49825	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.194458961 CET	49826	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.194468975 CET	443	49826	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.194526911 CET	49826	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.196067095 CET	49826	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.196078062 CET	443	49826	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.196103096 CET	443	49826	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.196392059 CET	49827	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.196400881 CET	443	49827	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.196481943 CET	49827	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.198601961 CET	49827	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.198615074 CET	443	49827	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.198637962 CET	443	49827	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.198899984 CET	49828	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.198925018 CET	443	49828	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.198983908 CET	49828	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.201584101 CET	49828	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.201597929 CET	443	49828	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.201625109 CET	443	49828	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.201894045 CET	49829	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.201910973 CET	443	49829	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.202039957 CET	49829	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.203742027 CET	49829	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.203767061 CET	443	49829	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.203792095 CET	443	49829	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.204026937 CET	49830	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.204041958 CET	443	49830	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.204112053 CET	49830	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.205511093 CET	49830	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.205526114 CET	443	49830	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.205545902 CET	443	49830	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.205807924 CET	49831	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.205821037 CET	443	49831	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.205869913 CET	49831	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.207293987 CET	49831	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.207305908 CET	443	49831	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.207329035 CET	443	49831	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.207541943 CET	49832	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.207583904 CET	443	49832	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.207659006 CET	49832	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.209038973 CET	49832	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.209072113 CET	443	49832	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.209090948 CET	443	49832	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.209300041 CET	49833	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.209321022 CET	443	49833	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.209372044 CET	49833	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.210760117 CET	49833	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.210773945 CET	443	49833	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.210794926 CET	443	49833	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.211026907 CET	49834	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.211061954 CET	443	49834	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.211108923 CET	49834	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.212508917 CET	49834	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.212551117 CET	443	49834	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.212569952 CET	443	49834	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.212785006 CET	49835	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.212800026 CET	443	49835	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.212851048 CET	49835	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.214837074 CET	49835	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.214852095 CET	443	49835	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.214873075 CET	443	49835	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.215126991 CET	49836	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.215140104 CET	443	49836	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.215198994 CET	49836	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.217039108 CET	49836	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.217051029 CET	443	49836	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.217084885 CET	443	49836	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.217353106 CET	49837	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.217382908 CET	443	49837	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.217442036 CET	49837	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.218956947 CET	49837	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.218971014 CET	443	49837	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.218995094 CET	443	49837	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.219228029 CET	49838	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.219237089 CET	443	49838	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.219290018 CET	49838	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.221199036 CET	49838	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.221210003 CET	443	49838	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.221235037 CET	443	49838	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.221486092 CET	49839	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.221503973 CET	443	49839	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.221581936 CET	49839	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.223113060 CET	49839	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.223126888 CET	443	49839	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.223150969 CET	443	49839	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.223403931 CET	49840	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.223433018 CET	443	49840	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.223501921 CET	49840	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.225011110 CET	49840	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.225023985 CET	443	49840	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.225044966 CET	443	49840	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.225271940 CET	49841	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.225327969 CET	443	49841	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.225389004 CET	49841	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.227175951 CET	49841	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.227206945 CET	443	49841	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.227229118 CET	443	49841	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.227483988 CET	49842	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.227499962 CET	443	49842	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.227555037 CET	49842	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.233010054 CET	49842	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.233023882 CET	443	49842	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.233094931 CET	443	49842	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.233345985 CET	49843	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.233393908 CET	443	49843	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.233488083 CET	49843	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.235008001 CET	49843	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.235044003 CET	443	49843	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.235080004 CET	443	49843	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.235344887 CET	49844	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.235366106 CET	443	49844	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.235420942 CET	49844	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.237231970 CET	49844	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.237245083 CET	443	49844	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.237267017 CET	443	49844	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.237799883 CET	49845	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.237828016 CET	443	49845	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.237893105 CET	49845	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.239381075 CET	49845	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.239392042 CET	443	49845	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.239424944 CET	443	49845	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.239655972 CET	49846	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.239665985 CET	443	49846	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.239723921 CET	49846	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.241349936 CET	49846	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.241364002 CET	443	49846	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.241386890 CET	443	49846	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.241647959 CET	49847	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.241662025 CET	443	49847	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.241714954 CET	49847	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.243222952 CET	49847	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.243237972 CET	443	49847	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.243263960 CET	443	49847	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.243520021 CET	49848	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.243549109 CET	443	49848	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.243716955 CET	49848	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.245291948 CET	49848	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.245305061 CET	443	49848	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.245327950 CET	443	49848	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.245572090 CET	49849	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.245595932 CET	443	49849	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.245724916 CET	49849	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.247956038 CET	49849	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.247968912 CET	443	49849	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.247993946 CET	443	49849	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.248869896 CET	49850	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.248881102 CET	443	49850	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.248950958 CET	49850	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.250387907 CET	49850	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.250400066 CET	443	49850	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.250433922 CET	443	49850	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.250653982 CET	49851	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.250663996 CET	443	49851	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.250727892 CET	49851	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.252188921 CET	49851	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.252199888 CET	443	49851	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.252223969 CET	443	49851	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.252458096 CET	49852	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.252502918 CET	443	49852	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.252671003 CET	49852	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.253947020 CET	49852	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.253962994 CET	443	49852	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.253983021 CET	443	49852	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.254189014 CET	49853	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.254218102 CET	443	49853	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.254329920 CET	49853	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.255625010 CET	49853	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.255641937 CET	443	49853	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.255662918 CET	443	49853	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.255908012 CET	49854	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.255918980 CET	443	49854	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.255970955 CET	49854	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.257333994 CET	49854	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.257345915 CET	443	49854	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.257368088 CET	443	49854	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.257555962 CET	49855	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.257576942 CET	443	49855	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.257626057 CET	49855	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.258965969 CET	49855	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.258982897 CET	443	49855	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.259004116 CET	443	49855	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.259418964 CET	49856	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.259440899 CET	443	49856	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.259493113 CET	49856	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.306211948 CET	49856	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.306248903 CET	443	49856	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.306288958 CET	443	49856	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.306993961 CET	49857	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.307043076 CET	443	49857	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.307121992 CET	49857	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.308876991 CET	49857	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.308892965 CET	443	49857	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.308921099 CET	443	49857	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.309211016 CET	49858	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.309252024 CET	443	49858	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.309312105 CET	49858	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.311379910 CET	49858	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.311393976 CET	443	49858	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.311418056 CET	443	49858	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.311655998 CET	49859	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.311667919 CET	443	49859	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.311748028 CET	49859	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.313249111 CET	49859	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.313263893 CET	443	49859	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.313288927 CET	443	49859	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.313571930 CET	49860	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.313607931 CET	443	49860	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.313735962 CET	49860	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.315295935 CET	49860	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.315310001 CET	443	49860	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.315336943 CET	443	49860	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.315588951 CET	49861	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.315617085 CET	443	49861	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.315701008 CET	49861	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.317256927 CET	49861	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.317272902 CET	443	49861	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.317293882 CET	443	49861	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.317625999 CET	49862	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.317639112 CET	443	49862	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.317744017 CET	49862	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.319205046 CET	49862	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.319216967 CET	443	49862	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.319240093 CET	443	49862	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.319516897 CET	49863	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.319525957 CET	443	49863	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.319627047 CET	49863	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.321118116 CET	49863	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.321130037 CET	443	49863	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.321151018 CET	443	49863	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.321384907 CET	49864	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.321429968 CET	443	49864	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.321490049 CET	49864	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.323324919 CET	49864	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.323339939 CET	443	49864	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.323367119 CET	443	49864	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.323645115 CET	49865	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.323678017 CET	443	49865	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.323760986 CET	49865	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.331335068 CET	49865	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.331350088 CET	443	49865	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.331373930 CET	443	49865	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.331654072 CET	49866	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.331681013 CET	443	49866	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.331764936 CET	49866	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.333260059 CET	49866	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.333276987 CET	443	49866	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.333297014 CET	443	49866	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.333530903 CET	49867	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.333547115 CET	443	49867	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.333602905 CET	49867	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.335110903 CET	49867	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.335123062 CET	443	49867	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.335144997 CET	443	49867	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.335668087 CET	49868	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.335706949 CET	443	49868	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.335767031 CET	49868	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.337382078 CET	49868	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.337393999 CET	443	49868	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.337414026 CET	443	49868	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.337641954 CET	49869	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.337690115 CET	443	49869	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.337755919 CET	49869	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.339530945 CET	49869	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.339544058 CET	443	49869	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.339560032 CET	443	49869	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.339787960 CET	49870	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.339799881 CET	443	49870	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.339854956 CET	49870	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.341231108 CET	49870	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.341243029 CET	443	49870	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.341265917 CET	443	49870	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.341514111 CET	49871	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.341535091 CET	443	49871	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.341588974 CET	49871	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.343004942 CET	49871	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.343024969 CET	443	49871	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.343046904 CET	443	49871	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.343262911 CET	49872	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.343276024 CET	443	49872	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.343337059 CET	49872	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.344780922 CET	49872	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.344793081 CET	443	49872	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.344814062 CET	443	49872	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.345082998 CET	49873	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.345107079 CET	443	49873	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.345166922 CET	49873	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.346784115 CET	49873	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.346796989 CET	443	49873	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.346821070 CET	443	49873	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.347079992 CET	49874	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.347089052 CET	443	49874	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.347145081 CET	49874	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.348871946 CET	49874	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.348882914 CET	443	49874	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.348906040 CET	443	49874	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.349136114 CET	49875	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.349148989 CET	443	49875	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.349199057 CET	49875	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.350703955 CET	49875	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.350717068 CET	443	49875	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.350743055 CET	443	49875	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.350999117 CET	49876	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.351015091 CET	443	49876	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.351070881 CET	49876	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.352564096 CET	49876	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.352580070 CET	443	49876	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.352602005 CET	443	49876	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.352833986 CET	49877	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.352853060 CET	443	49877	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.352905035 CET	49877	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.355043888 CET	49877	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.355056047 CET	443	49877	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.355082989 CET	443	49877	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.355346918 CET	49878	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.355369091 CET	443	49878	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.355448008 CET	49878	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.356904030 CET	49878	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.356921911 CET	443	49878	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.356952906 CET	443	49878	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.357157946 CET	49879	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.357172012 CET	443	49879	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.357224941 CET	49879	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.358664036 CET	49879	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.358674049 CET	443	49879	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.358700037 CET	443	49879	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.358987093 CET	49880	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.359030008 CET	443	49880	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.359102964 CET	49880	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.360858917 CET	49880	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.360878944 CET	443	49880	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.360903978 CET	443	49880	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.361160040 CET	49881	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.361206055 CET	443	49881	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.361341953 CET	49881	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.362921953 CET	49881	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.362937927 CET	443	49881	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.362960100 CET	443	49881	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.363250971 CET	49882	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.363265991 CET	443	49882	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.363334894 CET	49882	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.364867926 CET	49882	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.364882946 CET	443	49882	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.364907026 CET	443	49882	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.365175009 CET	49883	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.365191936 CET	443	49883	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.365253925 CET	49883	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.366975069 CET	49883	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.366988897 CET	443	49883	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.367022991 CET	443	49883	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.367299080 CET	49884	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.367328882 CET	443	49884	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.367379904 CET	49884	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.368927956 CET	49884	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.368942022 CET	443	49884	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.368973970 CET	443	49884	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.369242907 CET	49885	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.369271040 CET	443	49885	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.369399071 CET	49885	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.371304989 CET	49885	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.371323109 CET	443	49885	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.371354103 CET	443	49885	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.371635914 CET	49886	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.371649981 CET	443	49886	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.371726036 CET	49886	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.373183012 CET	49886	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.373203039 CET	443	49886	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.373220921 CET	443	49886	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.373485088 CET	49887	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.373496056 CET	443	49887	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.373586893 CET	49887	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.375093937 CET	49887	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.375104904 CET	443	49887	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.375129938 CET	443	49887	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.375380993 CET	49888	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.375406027 CET	443	49888	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.375468016 CET	49888	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.376986027 CET	49888	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.376998901 CET	443	49888	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.377019882 CET	443	49888	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.377264977 CET	49889	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.377284050 CET	443	49889	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.377343893 CET	49889	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.379134893 CET	49889	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.379147053 CET	443	49889	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.379174948 CET	443	49889	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.379472017 CET	49890	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.379486084 CET	443	49890	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.379540920 CET	49890	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.381304979 CET	49890	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.381320000 CET	443	49890	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.381342888 CET	443	49890	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.381561041 CET	49891	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.381570101 CET	443	49891	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.381624937 CET	49891	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.383126020 CET	49891	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.383137941 CET	443	49891	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.383167982 CET	443	49891	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.383426905 CET	49892	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.383452892 CET	443	49892	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.383548021 CET	49892	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.385163069 CET	49892	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.385174036 CET	443	49892	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.385196924 CET	443	49892	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.385425091 CET	49893	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.385442972 CET	443	49893	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.385499954 CET	49893	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.387316942 CET	49893	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.387325048 CET	443	49893	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.387362957 CET	443	49893	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.387619019 CET	49894	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.387630939 CET	443	49894	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.387700081 CET	49894	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.389211893 CET	49894	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.389224052 CET	443	49894	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.389262915 CET	443	49894	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.389825106 CET	49895	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.389837027 CET	443	49895	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.389951944 CET	49895	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.391422033 CET	49895	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.391433001 CET	443	49895	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.391462088 CET	443	49895	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.391725063 CET	49896	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.391748905 CET	443	49896	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.391830921 CET	49896	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.393373013 CET	49896	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.393387079 CET	443	49896	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.393409014 CET	443	49896	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.393656969 CET	49897	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.393686056 CET	443	49897	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.393755913 CET	49897	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.395201921 CET	49897	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.395216942 CET	443	49897	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.395241022 CET	443	49897	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.395555973 CET	49898	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.395567894 CET	443	49898	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.395673037 CET	49898	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.397156954 CET	49898	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.397169113 CET	443	49898	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.397191048 CET	443	49898	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.397411108 CET	49899	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.397433043 CET	443	49899	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.397490025 CET	49899	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.399008989 CET	49899	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.399024963 CET	443	49899	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.399049044 CET	443	49899	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.399418116 CET	49900	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.399432898 CET	443	49900	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.399502993 CET	49900	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.402134895 CET	49900	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.402149916 CET	443	49900	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.402189016 CET	443	49900	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.402479887 CET	49901	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.402499914 CET	443	49901	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.402553082 CET	49901	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.405081034 CET	49901	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.405096054 CET	443	49901	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.405122995 CET	443	49901	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.405416965 CET	49902	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.405432940 CET	443	49902	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.405555964 CET	49902	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.407711029 CET	49902	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.407726049 CET	443	49902	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.407748938 CET	443	49902	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.408023119 CET	49903	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.408034086 CET	443	49903	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.408117056 CET	49903	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.409693003 CET	49903	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.409706116 CET	443	49903	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.409739971 CET	443	49903	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.410034895 CET	49904	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.410063028 CET	443	49904	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.410123110 CET	49904	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.411576986 CET	49904	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.411591053 CET	443	49904	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.411612988 CET	443	49904	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.411859989 CET	49905	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.411884069 CET	443	49905	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.412061930 CET	49905	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.413352966 CET	49905	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.413366079 CET	443	49905	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.413388014 CET	443	49905	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.413606882 CET	49906	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.413615942 CET	443	49906	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.413670063 CET	49906	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.415081978 CET	49906	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.415095091 CET	443	49906	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.415117025 CET	443	49906	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.415627956 CET	49907	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.415638924 CET	443	49907	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.415704012 CET	49907	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.417323112 CET	49907	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.417336941 CET	443	49907	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.417362928 CET	443	49907	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.417587996 CET	49908	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.417598963 CET	443	49908	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.417668104 CET	49908	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.419069052 CET	49908	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.419080019 CET	443	49908	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.419106007 CET	443	49908	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.419317007 CET	49909	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.419329882 CET	443	49909	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.419383049 CET	49909	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.420747042 CET	49909	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.420759916 CET	443	49909	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.420782089 CET	443	49909	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.421010017 CET	49910	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.421020031 CET	443	49910	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.421072960 CET	49910	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.422491074 CET	49910	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.422499895 CET	443	49910	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.422796965 CET	443	49910	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.423058033 CET	49911	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.423069000 CET	443	49911	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.423167944 CET	49911	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.424525023 CET	49911	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.424540043 CET	443	49911	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.424566031 CET	443	49911	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.424783945 CET	49912	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.424798965 CET	443	49912	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.424855947 CET	49912	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.426295996 CET	49912	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.426306963 CET	443	49912	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.426326990 CET	443	49912	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.426534891 CET	49913	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.426567078 CET	443	49913	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.426623106 CET	49913	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.428759098 CET	49913	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.428776026 CET	443	49913	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.428795099 CET	443	49913	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.429033995 CET	49914	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.429047108 CET	443	49914	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.429100037 CET	49914	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.430524111 CET	49914	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.430533886 CET	443	49914	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.430552006 CET	443	49914	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.430763960 CET	49915	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.430780888 CET	443	49915	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.430834055 CET	49915	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.432979107 CET	49915	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.432992935 CET	443	49915	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.433013916 CET	443	49915	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.433279991 CET	49916	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.433291912 CET	443	49916	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.433336973 CET	49916	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.434905052 CET	49916	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.434916019 CET	443	49916	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.434937000 CET	443	49916	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.435206890 CET	49917	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.435226917 CET	443	49917	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.435280085 CET	49917	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.436778069 CET	49917	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.436790943 CET	443	49917	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.436813116 CET	443	49917	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.437053919 CET	49918	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.437062025 CET	443	49918	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.437114000 CET	49918	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.438565016 CET	49918	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.438575029 CET	443	49918	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.438592911 CET	443	49918	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.438806057 CET	49919	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.438816071 CET	443	49919	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.438870907 CET	49919	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.440638065 CET	49919	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.440651894 CET	443	49919	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.440674067 CET	443	49919	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.440910101 CET	49920	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.440937996 CET	443	49920	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.440990925 CET	49920	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.442461014 CET	49920	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.442472935 CET	443	49920	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.442553043 CET	443	49920	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.442827940 CET	49921	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.442845106 CET	443	49921	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.442950964 CET	49921	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.444355965 CET	49921	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.444367886 CET	443	49921	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.444418907 CET	443	49921	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.444645882 CET	49922	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.444659948 CET	443	49922	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.444708109 CET	49922	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.446187019 CET	49922	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.446197987 CET	443	49922	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.446283102 CET	443	49922	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.446538925 CET	49923	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.446548939 CET	443	49923	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.446770906 CET	49923	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.448380947 CET	49923	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.448393106 CET	443	49923	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.448455095 CET	443	49923	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.448714018 CET	49924	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.448731899 CET	443	49924	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.448834896 CET	49924	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.450295925 CET	49924	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.450306892 CET	443	49924	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.450337887 CET	443	49924	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.450555086 CET	49925	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.450570107 CET	443	49925	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.450627089 CET	49925	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.452372074 CET	49925	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.452389956 CET	443	49925	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.452410936 CET	443	49925	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.452660084 CET	49926	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.452676058 CET	443	49926	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.452758074 CET	49926	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.454219103 CET	49926	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.454229116 CET	443	49926	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.454305887 CET	443	49926	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.454567909 CET	49927	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.454586983 CET	443	49927	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.454664946 CET	49927	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.456131935 CET	49927	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.456151009 CET	443	49927	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.456171036 CET	443	49927	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.456396103 CET	49928	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.456409931 CET	443	49928	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.456465960 CET	49928	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.458086967 CET	49928	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.458096027 CET	443	49928	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.458223104 CET	443	49928	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.458466053 CET	49929	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.458488941 CET	443	49929	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.458549976 CET	49929	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.459969044 CET	49929	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.459983110 CET	443	49929	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.460030079 CET	443	49929	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.460256100 CET	49930	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.460267067 CET	443	49930	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.460323095 CET	49930	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.461715937 CET	49930	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.461734056 CET	443	49930	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.461791039 CET	443	49930	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.462167978 CET	49931	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.462179899 CET	443	49931	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.462228060 CET	49931	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.464378119 CET	49931	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.464391947 CET	443	49931	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.464421034 CET	443	49931	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.464653969 CET	49932	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.464663982 CET	443	49932	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.464715004 CET	49932	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.466104031 CET	49932	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.466111898 CET	443	49932	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.466130018 CET	443	49932	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.466335058 CET	49933	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.466368914 CET	443	49933	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.466443062 CET	49933	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.467889071 CET	49933	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.467902899 CET	443	49933	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.467931032 CET	443	49933	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.468178988 CET	49934	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.468188047 CET	443	49934	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.468236923 CET	49934	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.469913006 CET	49934	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.469926119 CET	443	49934	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.469949007 CET	443	49934	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.470185041 CET	49935	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.470196962 CET	443	49935	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.470278978 CET	49935	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.471800089 CET	49935	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.471813917 CET	443	49935	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.471843004 CET	443	49935	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.472064972 CET	49936	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.472079039 CET	443	49936	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.472136974 CET	49936	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.473611116 CET	49936	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.473623991 CET	443	49936	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.473653078 CET	443	49936	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.473871946 CET	49937	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.473884106 CET	443	49937	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.473938942 CET	49937	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.475656986 CET	49937	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.475667953 CET	443	49937	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.475697041 CET	443	49937	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.475929022 CET	49938	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.475939989 CET	443	49938	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.475991964 CET	49938	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.477714062 CET	49938	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.477726936 CET	443	49938	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.477775097 CET	443	49938	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.477993011 CET	49939	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.478002071 CET	443	49939	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.478058100 CET	49939	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.479531050 CET	49939	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.479541063 CET	443	49939	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.479571104 CET	443	49939	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.479794979 CET	49940	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.479809046 CET	443	49940	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.479867935 CET	49940	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.481312990 CET	49940	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.481326103 CET	443	49940	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.481349945 CET	443	49940	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.481580019 CET	49941	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.481589079 CET	443	49941	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.481637001 CET	49941	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.483062029 CET	49941	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.483069897 CET	443	49941	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.483093977 CET	443	49941	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.483325005 CET	49942	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.483335972 CET	443	49942	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.483391047 CET	49942	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.484843016 CET	49942	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.484858036 CET	443	49942	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.484883070 CET	443	49942	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.485089064 CET	49943	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.485095978 CET	443	49943	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.485146046 CET	49943	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.486521006 CET	49943	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.486529112 CET	443	49943	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.486671925 CET	443	49943	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.486936092 CET	49944	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.486960888 CET	443	49944	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.487016916 CET	49944	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.488477945 CET	49944	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.488490105 CET	443	49944	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.488512993 CET	443	49944	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.488712072 CET	49945	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.488743067 CET	443	49945	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.488796949 CET	49945	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.490391016 CET	49945	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.490406990 CET	443	49945	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.490430117 CET	443	49945	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.490744114 CET	49946	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.490756989 CET	443	49946	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.490838051 CET	49946	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.492356062 CET	49946	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.492367983 CET	443	49946	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.492397070 CET	443	49946	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.492615938 CET	49947	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.492635965 CET	443	49947	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.492719889 CET	49947	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.494182110 CET	49947	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.494198084 CET	443	49947	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.494220018 CET	443	49947	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.494793892 CET	49948	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.494813919 CET	443	49948	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.494870901 CET	49948	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.496393919 CET	49948	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.496407986 CET	443	49948	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.496432066 CET	443	49948	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.496707916 CET	49949	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.496727943 CET	443	49949	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.496805906 CET	49949	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.498719931 CET	49949	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.498733044 CET	443	49949	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.498759985 CET	443	49949	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.499013901 CET	49950	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.499025106 CET	443	49950	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.499088049 CET	49950	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.500660896 CET	49950	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.500674963 CET	443	49950	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.500699043 CET	443	49950	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.500943899 CET	49951	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.500953913 CET	443	49951	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.501029015 CET	49951	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.505032063 CET	49951	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.505044937 CET	443	49951	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.505069971 CET	443	49951	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.505327940 CET	49952	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.505356073 CET	443	49952	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.505409956 CET	49952	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.506902933 CET	49952	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.506917953 CET	443	49952	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.506946087 CET	443	49952	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.507253885 CET	49953	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.507282972 CET	443	49953	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.507338047 CET	49953	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.508912086 CET	49953	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.508920908 CET	443	49953	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.508948088 CET	443	49953	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.509177923 CET	49954	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.509191990 CET	443	49954	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.509299040 CET	49954	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.511127949 CET	49954	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.511141062 CET	443	49954	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.511166096 CET	443	49954	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.511415005 CET	49955	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.511425018 CET	443	49955	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.511475086 CET	49955	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.513298988 CET	49955	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.513310909 CET	443	49955	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.513339043 CET	443	49955	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.513583899 CET	49956	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.513607025 CET	443	49956	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.513669014 CET	49956	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.515254021 CET	49956	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.515268087 CET	443	49956	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.515295029 CET	443	49956	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.515803099 CET	49957	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.515834093 CET	443	49957	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.515888929 CET	49957	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.517350912 CET	49957	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.517365932 CET	443	49957	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.517390013 CET	443	49957	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.517612934 CET	49958	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.517627954 CET	443	49958	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.517682076 CET	49958	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.519089937 CET	49958	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.519103050 CET	443	49958	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.519123077 CET	443	49958	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.519337893 CET	49959	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.519350052 CET	443	49959	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.519397020 CET	49959	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.520816088 CET	49959	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.520828962 CET	443	49959	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.520854950 CET	443	49959	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.521085024 CET	49960	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.521114111 CET	443	49960	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.521239996 CET	49960	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.522639036 CET	49960	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.522659063 CET	443	49960	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.522680998 CET	443	49960	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.522880077 CET	49961	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.522912025 CET	443	49961	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.522962093 CET	49961	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.524405003 CET	49961	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.524420023 CET	443	49961	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.524444103 CET	443	49961	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.524693012 CET	49962	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.524705887 CET	443	49962	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.524780035 CET	49962	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.526648045 CET	49962	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.526659966 CET	443	49962	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.526684046 CET	443	49962	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.526921034 CET	49963	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.526935101 CET	443	49963	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.526988983 CET	49963	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.528481960 CET	49963	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.528492928 CET	443	49963	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.528523922 CET	443	49963	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.528781891 CET	49964	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.528808117 CET	443	49964	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.528873920 CET	49964	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.530368090 CET	49964	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.530383110 CET	443	49964	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.530416012 CET	443	49964	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.530643940 CET	49965	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.530674934 CET	443	49965	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.530730963 CET	49965	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.532383919 CET	49965	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.532394886 CET	443	49965	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.532428980 CET	443	49965	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.532711029 CET	49966	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.532727003 CET	443	49966	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.532785892 CET	49966	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.534614086 CET	49966	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.534627914 CET	443	49966	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.534663916 CET	443	49966	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.534939051 CET	49967	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.534951925 CET	443	49967	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.535100937 CET	49967	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.536499023 CET	49967	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.536510944 CET	443	49967	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.536547899 CET	443	49967	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.537045002 CET	49968	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.537070036 CET	443	49968	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.537126064 CET	49968	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.538602114 CET	49968	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.538615942 CET	443	49968	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.538640976 CET	443	49968	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.538861036 CET	49969	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.538882971 CET	443	49969	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.538969040 CET	49969	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.540411949 CET	49969	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.540426016 CET	443	49969	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.540450096 CET	443	49969	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.540677071 CET	49970	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.540690899 CET	443	49970	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.540747881 CET	49970	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.542505980 CET	49970	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.542525053 CET	443	49970	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.542546034 CET	443	49970	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.542793036 CET	49971	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.542810917 CET	443	49971	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.542886019 CET	49971	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.544322014 CET	49971	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.544337034 CET	443	49971	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.544361115 CET	443	49971	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.544584036 CET	49972	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.544600010 CET	443	49972	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.544692039 CET	49972	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.546365023 CET	49972	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.546375990 CET	443	49972	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.546401024 CET	443	49972	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.546623945 CET	49973	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.546647072 CET	443	49973	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.546705008 CET	49973	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.548157930 CET	49973	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.548172951 CET	443	49973	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.548188925 CET	443	49973	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.548439026 CET	49974	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.548449039 CET	443	49974	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.548507929 CET	49974	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.550323009 CET	49974	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.550332069 CET	443	49974	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.550352097 CET	443	49974	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.550617933 CET	49975	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.550631046 CET	443	49975	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.550697088 CET	49975	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.552520037 CET	49975	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.552534103 CET	443	49975	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.552551985 CET	443	49975	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.552786112 CET	49976	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.552815914 CET	443	49976	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.552871943 CET	49976	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.554591894 CET	49976	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.554603100 CET	443	49976	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.554630041 CET	443	49976	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.554851055 CET	49977	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.554878950 CET	443	49977	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.554934025 CET	49977	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.556467056 CET	49977	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.556485891 CET	443	49977	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.556504965 CET	443	49977	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.556745052 CET	49978	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.556755066 CET	443	49978	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.556807041 CET	49978	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.558720112 CET	49978	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.558731079 CET	443	49978	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.558758020 CET	443	49978	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.558990002 CET	49979	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.559003115 CET	443	49979	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.559065104 CET	49979	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.560457945 CET	49979	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.560472012 CET	443	49979	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.560493946 CET	443	49979	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.560709953 CET	49980	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.560724974 CET	443	49980	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.560781956 CET	49980	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.562207937 CET	49980	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.562218904 CET	443	49980	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.562261105 CET	443	49980	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.562505960 CET	49981	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.562542915 CET	443	49981	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.562599897 CET	49981	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.563990116 CET	49981	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.564003944 CET	443	49981	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.564027071 CET	443	49981	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.564250946 CET	49982	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.564260960 CET	443	49982	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.564342022 CET	49982	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.565773010 CET	49982	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.565783978 CET	443	49982	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.565809011 CET	443	49982	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.566024065 CET	49983	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.566034079 CET	443	49983	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.566096067 CET	49983	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.567789078 CET	49983	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.567804098 CET	443	49983	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.567823887 CET	443	49983	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.568073034 CET	49984	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.568082094 CET	443	49984	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.568141937 CET	49984	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.569515944 CET	49984	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.569528103 CET	443	49984	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.569550991 CET	443	49984	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.569756031 CET	49985	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.569772959 CET	443	49985	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.569823027 CET	49985	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.571249008 CET	49985	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.571261883 CET	443	49985	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.571285009 CET	443	49985	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.571512938 CET	49986	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.571527958 CET	443	49986	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.571579933 CET	49986	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.573715925 CET	49986	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.573729992 CET	443	49986	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.573754072 CET	443	49986	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.576972008 CET	49987	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.577019930 CET	443	49987	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.577094078 CET	49987	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.578799009 CET	49987	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.578813076 CET	443	49987	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.578845978 CET	443	49987	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.579724073 CET	49988	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.579752922 CET	443	49988	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.579813004 CET	49988	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.581191063 CET	49988	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.581204891 CET	443	49988	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.581228018 CET	443	49988	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.581464052 CET	49989	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.581490040 CET	443	49989	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.581552982 CET	49989	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.583090067 CET	49989	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.583101988 CET	443	49989	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.583128929 CET	443	49989	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.583364964 CET	49990	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.583379030 CET	443	49990	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.583426952 CET	49990	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.584856987 CET	49990	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.584870100 CET	443	49990	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.584892035 CET	443	49990	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.585099936 CET	49991	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.585114956 CET	443	49991	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.585165977 CET	49991	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.586568117 CET	49991	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.586590052 CET	443	49991	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.586613894 CET	443	49991	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.586833000 CET	49992	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.586869001 CET	443	49992	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.586920977 CET	49992	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.595983028 CET	49992	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.596008062 CET	443	49992	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.596039057 CET	443	49992	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.600110054 CET	49993	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.600141048 CET	443	49993	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.600263119 CET	49993	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.635278940 CET	49993	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.635303020 CET	443	49993	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.635355949 CET	443	49993	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.635653973 CET	49994	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.635695934 CET	443	49994	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.635755062 CET	49994	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.637291908 CET	49994	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.637306929 CET	443	49994	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.637331009 CET	443	49994	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.637558937 CET	49995	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.637583971 CET	443	49995	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.637674093 CET	49995	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.639349937 CET	49995	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.639363050 CET	443	49995	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.639389038 CET	443	49995	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.639718056 CET	49996	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.639754057 CET	443	49996	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.639839888 CET	49996	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.641258001 CET	49996	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.641283035 CET	443	49996	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.641304016 CET	443	49996	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.641541958 CET	49997	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.641566992 CET	443	49997	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.641618013 CET	49997	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.643241882 CET	49997	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.643256903 CET	443	49997	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.643280029 CET	443	49997	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.643534899 CET	49998	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.643546104 CET	443	49998	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.643646002 CET	49998	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.645045996 CET	49998	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.645061016 CET	443	49998	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.645085096 CET	443	49998	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.645287037 CET	49999	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.645302057 CET	443	49999	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.645356894 CET	49999	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.646707058 CET	49999	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.646719933 CET	443	49999	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.646744013 CET	443	49999	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.647025108 CET	50000	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.647037983 CET	443	50000	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.647092104 CET	50000	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.648463964 CET	50000	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.648480892 CET	443	50000	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.648504972 CET	443	50000	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.648737907 CET	50001	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.648756027 CET	443	50001	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.648802042 CET	50001	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.650151968 CET	50001	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.650166035 CET	443	50001	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.650187969 CET	443	50001	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.650413990 CET	50002	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.650424004 CET	443	50002	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.650476933 CET	50002	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.652769089 CET	50002	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.652777910 CET	443	50002	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.652816057 CET	443	50002	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.653040886 CET	50003	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.653054953 CET	443	50003	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.653107882 CET	50003	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.654577971 CET	50003	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.654591084 CET	443	50003	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.654612064 CET	443	50003	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.654865026 CET	50004	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.654880047 CET	443	50004	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.654927015 CET	50004	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.656342030 CET	50004	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.656357050 CET	443	50004	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.656379938 CET	443	50004	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.656586885 CET	50005	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.656599998 CET	443	50005	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.656676054 CET	50005	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.658025026 CET	50005	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.658040047 CET	443	50005	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.658065081 CET	443	50005	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.658278942 CET	50006	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.658288956 CET	443	50006	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.658341885 CET	50006	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.659821987 CET	50006	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.659838915 CET	443	50006	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.659858942 CET	443	50006	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.660124063 CET	50007	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.660135984 CET	443	50007	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.660223961 CET	50007	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.661706924 CET	50007	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.661720991 CET	443	50007	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.661741972 CET	443	50007	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.662163019 CET	50008	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.662214041 CET	443	50008	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.662266970 CET	50008	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.663721085 CET	50008	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.663736105 CET	443	50008	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.663767099 CET	443	50008	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.663995028 CET	50009	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.664036989 CET	443	50009	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.664138079 CET	50009	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.665546894 CET	50009	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.665565014 CET	443	50009	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.665584087 CET	443	50009	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.665817976 CET	50010	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.665832043 CET	443	50010	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.665893078 CET	50010	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.667718887 CET	50010	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.667732000 CET	443	50010	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.667757988 CET	443	50010	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.667968988 CET	50011	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.667983055 CET	443	50011	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.668035030 CET	50011	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.669498920 CET	50011	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.669512033 CET	443	50011	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.669533968 CET	443	50011	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.669763088 CET	50012	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.669791937 CET	443	50012	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.669855118 CET	50012	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.671516895 CET	50012	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.671530008 CET	443	50012	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.671555042 CET	443	50012	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.671852112 CET	50013	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.671883106 CET	443	50013	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.671966076 CET	50013	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.673474073 CET	50013	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.673489094 CET	443	50013	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.673508883 CET	443	50013	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.673763037 CET	50014	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.673773050 CET	443	50014	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.673821926 CET	50014	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.675458908 CET	50014	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.675471067 CET	443	50014	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.675496101 CET	443	50014	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.675784111 CET	50015	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.675793886 CET	443	50015	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.675939083 CET	50015	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.677279949 CET	50015	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.677293062 CET	443	50015	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.677314043 CET	443	50015	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.677725077 CET	50016	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.677742958 CET	443	50016	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.677799940 CET	50016	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.679219007 CET	50016	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.679230928 CET	443	50016	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.679254055 CET	443	50016	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.679459095 CET	50017	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.679483891 CET	443	50017	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.679534912 CET	50017	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.680880070 CET	50017	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.680895090 CET	443	50017	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.680916071 CET	443	50017	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.681128979 CET	50018	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.681138039 CET	443	50018	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.681233883 CET	50018	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.682873964 CET	50018	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.682882071 CET	443	50018	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.682905912 CET	443	50018	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.683113098 CET	50019	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.683124065 CET	443	50019	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.683172941 CET	50019	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.684547901 CET	50019	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.684561014 CET	443	50019	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.684586048 CET	443	50019	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.684801102 CET	50020	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.684818983 CET	443	50020	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.684868097 CET	50020	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.686604023 CET	50020	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.686615944 CET	443	50020	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.686640024 CET	443	50020	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.686862946 CET	50021	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.686877012 CET	443	50021	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.687050104 CET	50021	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.688290119 CET	50021	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.688303947 CET	443	50021	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.688327074 CET	443	50021	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.688538074 CET	50022	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.688546896 CET	443	50022	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.688601017 CET	50022	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.690017939 CET	50022	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.690030098 CET	443	50022	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.690052032 CET	443	50022	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.690274954 CET	50023	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.690283060 CET	443	50023	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.690336943 CET	50023	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.691751003 CET	50023	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.691765070 CET	443	50023	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.691788912 CET	443	50023	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.692008972 CET	50024	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.692024946 CET	443	50024	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.692074060 CET	50024	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.693790913 CET	50024	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.693804026 CET	443	50024	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.693834066 CET	443	50024	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.694077969 CET	50025	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.694123983 CET	443	50025	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.694188118 CET	50025	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.695662975 CET	50025	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.695679903 CET	443	50025	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.695705891 CET	443	50025	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.695955038 CET	50026	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.695966005 CET	443	50026	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.696022034 CET	50026	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.697825909 CET	50026	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.697844028 CET	443	50026	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.697868109 CET	443	50026	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.698118925 CET	50027	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.698147058 CET	443	50027	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.698199987 CET	50027	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.699925900 CET	50027	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.699943066 CET	443	50027	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.699966908 CET	443	50027	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.700238943 CET	50028	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.700251102 CET	443	50028	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.700315952 CET	50028	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.701761961 CET	50028	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.701773882 CET	443	50028	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.701805115 CET	443	50028	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.702037096 CET	50029	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.702080965 CET	443	50029	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.702156067 CET	50029	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.703564882 CET	50029	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.703583956 CET	443	50029	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.703624010 CET	443	50029	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.703852892 CET	50030	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.703862906 CET	443	50030	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.703916073 CET	50030	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.705324888 CET	50030	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.705337048 CET	443	50030	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.705363035 CET	443	50030	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.705585003 CET	50031	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.705604076 CET	443	50031	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.705705881 CET	50031	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.707117081 CET	50031	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.707132101 CET	443	50031	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.707159996 CET	443	50031	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.707393885 CET	50032	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.707422972 CET	443	50032	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.707473993 CET	50032	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.708967924 CET	50032	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.708985090 CET	443	50032	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.709003925 CET	443	50032	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.709224939 CET	50033	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.709242105 CET	443	50033	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.709295034 CET	50033	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.711085081 CET	50033	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.711097956 CET	443	50033	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.711127043 CET	443	50033	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.711389065 CET	50034	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.711405993 CET	443	50034	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.711467028 CET	50034	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.713315010 CET	50034	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.713327885 CET	443	50034	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.713351011 CET	443	50034	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.714675903 CET	50035	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.714688063 CET	443	50035	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.714745045 CET	50035	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.716311932 CET	50035	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.716322899 CET	443	50035	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.716351032 CET	443	50035	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.716614962 CET	50036	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.716636896 CET	443	50036	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.716917038 CET	50036	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.718107939 CET	50036	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.718120098 CET	443	50036	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.718144894 CET	443	50036	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.718357086 CET	50037	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.718368053 CET	443	50037	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.718420982 CET	50037	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.719830036 CET	50037	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.719841003 CET	443	50037	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.719877958 CET	443	50037	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.720192909 CET	50038	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.720201969 CET	443	50038	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.720249891 CET	50038	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.721642017 CET	50038	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.721653938 CET	443	50038	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.721685886 CET	443	50038	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.721887112 CET	50039	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.721896887 CET	443	50039	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.721946955 CET	50039	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.723376036 CET	50039	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.723386049 CET	443	50039	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.723411083 CET	443	50039	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.723628044 CET	50040	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.723660946 CET	443	50040	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.723707914 CET	50040	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.725177050 CET	50040	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.725192070 CET	443	50040	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.725209951 CET	443	50040	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.725481033 CET	50041	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.725502014 CET	443	50041	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.725584030 CET	50041	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.727149963 CET	50041	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.727164984 CET	443	50041	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.727196932 CET	443	50041	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.727418900 CET	50042	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.727428913 CET	443	50042	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.727480888 CET	50042	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.729435921 CET	50042	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.729449987 CET	443	50042	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.729471922 CET	443	50042	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.729753971 CET	50043	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.729763985 CET	443	50043	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.729830027 CET	50043	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.731285095 CET	50043	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.731297016 CET	443	50043	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.731328964 CET	443	50043	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.731575012 CET	50044	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.731605053 CET	443	50044	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.731827021 CET	50044	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.745338917 CET	50044	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.745353937 CET	443	50044	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.745390892 CET	443	50044	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.745616913 CET	50045	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.745640039 CET	443	50045	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.745697975 CET	50045	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.747080088 CET	50045	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.747092962 CET	443	50045	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.747116089 CET	443	50045	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.747329950 CET	50046	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.747339964 CET	443	50046	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.747404099 CET	50046	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.748883963 CET	50046	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.748895884 CET	443	50046	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.748919964 CET	443	50046	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.749169111 CET	50047	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.749177933 CET	443	50047	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.749229908 CET	50047	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.750580072 CET	50047	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.750591993 CET	443	50047	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.750612974 CET	443	50047	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.750819921 CET	50048	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.750837088 CET	443	50048	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.750885963 CET	50048	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.760386944 CET	50048	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.760402918 CET	443	50048	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.760423899 CET	443	50048	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.760663033 CET	50049	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.760678053 CET	443	50049	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.760786057 CET	50049	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.762173891 CET	50049	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.762187004 CET	443	50049	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.762217045 CET	443	50049	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.762435913 CET	50050	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.762448072 CET	443	50050	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.762499094 CET	50050	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.763958931 CET	50050	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.763972044 CET	443	50050	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.763991117 CET	443	50050	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.764226913 CET	50051	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.764236927 CET	443	50051	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.764316082 CET	50051	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.765904903 CET	50051	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.765916109 CET	443	50051	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.765938997 CET	443	50051	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.766211033 CET	50052	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.766223907 CET	443	50052	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.766283989 CET	50052	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.767710924 CET	50052	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.767738104 CET	443	50052	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.767762899 CET	443	50052	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.767963886 CET	50053	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.767976046 CET	443	50053	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.768023014 CET	50053	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.769402027 CET	50053	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.769413948 CET	443	50053	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.769433022 CET	443	50053	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.769682884 CET	50054	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.769694090 CET	443	50054	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.769769907 CET	50054	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.771223068 CET	50054	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.771236897 CET	443	50054	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.771260977 CET	443	50054	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.771764040 CET	50055	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.771773100 CET	443	50055	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.771826029 CET	50055	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.773283005 CET	50055	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.773294926 CET	443	50055	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.773319006 CET	443	50055	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.773550034 CET	50056	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.773577929 CET	443	50056	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.773628950 CET	50056	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.775058985 CET	50056	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.775073051 CET	443	50056	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.775094032 CET	443	50056	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.775305986 CET	50057	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.775341034 CET	443	50057	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.775393009 CET	50057	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.777091026 CET	50057	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.777103901 CET	443	50057	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.777143002 CET	443	50057	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.777367115 CET	50058	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.777378082 CET	443	50058	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.777431965 CET	50058	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.778928995 CET	50058	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.778940916 CET	443	50058	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.778963089 CET	443	50058	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.779181004 CET	50059	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.779191017 CET	443	50059	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.779242039 CET	50059	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.781049967 CET	50059	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.781060934 CET	443	50059	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.781086922 CET	443	50059	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.781358957 CET	50060	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.781374931 CET	443	50060	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.781466961 CET	50060	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.782916069 CET	50060	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.782928944 CET	443	50060	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.782951117 CET	443	50060	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.783193111 CET	50061	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.783206940 CET	443	50061	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.783252954 CET	50061	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.784739017 CET	50061	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.784749031 CET	443	50061	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.784775972 CET	443	50061	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.785075903 CET	50062	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.785084963 CET	443	50062	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.785264969 CET	50062	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.786552906 CET	50062	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.786565065 CET	443	50062	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.786602020 CET	443	50062	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.786824942 CET	50063	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.786834002 CET	443	50063	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.786885977 CET	50063	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.788605928 CET	50063	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.788616896 CET	443	50063	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.788641930 CET	443	50063	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.788866997 CET	50064	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.788880110 CET	443	50064	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.788953066 CET	50064	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.790355921 CET	50064	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.790368080 CET	443	50064	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.790391922 CET	443	50064	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.790606976 CET	50065	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.790618896 CET	443	50065	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.790673018 CET	50065	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.792606115 CET	50065	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.792618990 CET	443	50065	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.792639971 CET	443	50065	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.792891026 CET	50066	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.792900085 CET	443	50066	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.792958021 CET	50066	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.794352055 CET	50066	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.794362068 CET	443	50066	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.794404984 CET	443	50066	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.794610023 CET	50067	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.794620037 CET	443	50067	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.794675112 CET	50067	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.796036959 CET	50067	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.796049118 CET	443	50067	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.796070099 CET	443	50067	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.796288967 CET	50068	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.796298981 CET	443	50068	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.796346903 CET	50068	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.797700882 CET	50068	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.797718048 CET	443	50068	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.797740936 CET	443	50068	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.797966003 CET	50069	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.797979116 CET	443	50069	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.798146963 CET	50069	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.799384117 CET	50069	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.799396992 CET	443	50069	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.799417019 CET	443	50069	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.799629927 CET	50070	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.799638987 CET	443	50070	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.799688101 CET	50070	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.801028013 CET	50070	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.801038027 CET	443	50070	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.801063061 CET	443	50070	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.801280022 CET	50071	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.801290035 CET	443	50071	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.801362991 CET	50071	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.802721977 CET	50071	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.802733898 CET	443	50071	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.802753925 CET	443	50071	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.803000927 CET	50072	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.803014994 CET	443	50072	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.803122997 CET	50072	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.804824114 CET	50072	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.804835081 CET	443	50072	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.804862976 CET	443	50072	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.805093050 CET	50073	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.805118084 CET	443	50073	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.805171967 CET	50073	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.806632042 CET	50073	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.806648016 CET	443	50073	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.806668043 CET	443	50073	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.809802055 CET	50074	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.809812069 CET	443	50074	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.809881926 CET	50074	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.811333895 CET	50074	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.811345100 CET	443	50074	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.811372042 CET	443	50074	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.811594009 CET	50075	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.811629057 CET	443	50075	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.811681032 CET	50075	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.813277006 CET	50075	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.813296080 CET	443	50075	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.813314915 CET	443	50075	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.813591003 CET	50076	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.813602924 CET	443	50076	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.813654900 CET	50076	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.815395117 CET	50076	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.815406084 CET	443	50076	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.815428019 CET	443	50076	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.815844059 CET	50077	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.815859079 CET	443	50077	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.815943956 CET	50077	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.817316055 CET	50077	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.817328930 CET	443	50077	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.817348957 CET	443	50077	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.817580938 CET	50078	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.817588091 CET	443	50078	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.817641973 CET	50078	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.819021940 CET	50078	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.819032907 CET	443	50078	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.819053888 CET	443	50078	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.819334030 CET	50079	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.819343090 CET	443	50079	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.819407940 CET	50079	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.820842028 CET	50079	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.820853949 CET	443	50079	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.820873976 CET	443	50079	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.821115971 CET	50080	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.821141958 CET	443	50080	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.821204901 CET	50080	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.823030949 CET	50080	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.823045015 CET	443	50080	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.823070049 CET	443	50080	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.823332071 CET	50081	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.823345900 CET	443	50081	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.823400974 CET	50081	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.824876070 CET	50081	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.824889898 CET	443	50081	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.824923038 CET	443	50081	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.825144053 CET	50082	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.825153112 CET	443	50082	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.825206041 CET	50082	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.826605082 CET	50082	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.826617002 CET	443	50082	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.826642036 CET	443	50082	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.826852083 CET	50083	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.826860905 CET	443	50083	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.826915979 CET	50083	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.828800917 CET	50083	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.828811884 CET	443	50083	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.828830004 CET	443	50083	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.829076052 CET	50084	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.829087973 CET	443	50084	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.829143047 CET	50084	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.830560923 CET	50084	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.830571890 CET	443	50084	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.830594063 CET	443	50084	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.830862999 CET	50085	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.830874920 CET	443	50085	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.830960035 CET	50085	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.832478046 CET	50085	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.832489967 CET	443	50085	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.832511902 CET	443	50085	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.832756996 CET	50086	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.832766056 CET	443	50086	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.832815886 CET	50086	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.834501028 CET	50086	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.834511995 CET	443	50086	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.834537029 CET	443	50086	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.834764957 CET	50087	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.834774017 CET	443	50087	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.834907055 CET	50087	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.836221933 CET	50087	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.836234093 CET	443	50087	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.836251974 CET	443	50087	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.836463928 CET	50088	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.836482048 CET	443	50088	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.836595058 CET	50088	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.837948084 CET	50088	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.837959051 CET	443	50088	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.837982893 CET	443	50088	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.838202953 CET	50089	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.838224888 CET	443	50089	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.838273048 CET	50089	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.839618921 CET	50089	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.839633942 CET	443	50089	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.839653969 CET	443	50089	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.840173960 CET	50090	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.840183973 CET	443	50090	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.840251923 CET	50090	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.841686010 CET	50090	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.841696978 CET	443	50090	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.841721058 CET	443	50090	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.841922998 CET	50091	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.841932058 CET	443	50091	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.841979980 CET	50091	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.843343973 CET	50091	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.843358994 CET	443	50091	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.843379974 CET	443	50091	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.843595982 CET	50092	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.843606949 CET	443	50092	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.843658924 CET	50092	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.845000029 CET	50092	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.845011950 CET	443	50092	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.845037937 CET	443	50092	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.845263004 CET	50093	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.845274925 CET	443	50093	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.845329046 CET	50093	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.846702099 CET	50093	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.846714020 CET	443	50093	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.846735954 CET	443	50093	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.846946001 CET	50094	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.846956968 CET	443	50094	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.847007990 CET	50094	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.848345041 CET	50094	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.848356962 CET	443	50094	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.848378897 CET	443	50094	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.848582983 CET	50095	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.848592043 CET	443	50095	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.848645926 CET	50095	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.850055933 CET	50095	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.850068092 CET	443	50095	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.850090981 CET	443	50095	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.850311995 CET	50096	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.850321054 CET	443	50096	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.850370884 CET	50096	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.852148056 CET	50096	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.852160931 CET	443	50096	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.852183104 CET	443	50096	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.852490902 CET	50097	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.852504015 CET	443	50097	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.852557898 CET	50097	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.858061075 CET	50097	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.858074903 CET	443	50097	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.858099937 CET	443	50097	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.858365059 CET	50098	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.858376980 CET	443	50098	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.858431101 CET	50098	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.859858036 CET	50098	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.859870911 CET	443	50098	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.859890938 CET	443	50098	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.860099077 CET	50099	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.860112906 CET	443	50099	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.860172033 CET	50099	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.861540079 CET	50099	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.861551046 CET	443	50099	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.861574888 CET	443	50099	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.861952066 CET	50100	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.861970901 CET	443	50100	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.862097025 CET	50100	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.863581896 CET	50100	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.863595009 CET	443	50100	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.863615990 CET	443	50100	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.863821030 CET	50101	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.863833904 CET	443	50101	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.863883018 CET	50101	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.865241051 CET	50101	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.865252018 CET	443	50101	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.865272999 CET	443	50101	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.865492105 CET	50102	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.865500927 CET	443	50102	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.865550995 CET	50102	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.866930008 CET	50102	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.866942883 CET	443	50102	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.866961956 CET	443	50102	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.867165089 CET	50103	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.867175102 CET	443	50103	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.867223978 CET	50103	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.868783951 CET	50103	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.868796110 CET	443	50103	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.868818045 CET	443	50103	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.869030952 CET	50104	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.869051933 CET	443	50104	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.869103909 CET	50104	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.902271986 CET	50104	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.902307987 CET	443	50104	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.902381897 CET	443	50104	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.912987947 CET	50105	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.913045883 CET	443	50105	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.913149118 CET	50105	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.979365110 CET	50105	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.979397058 CET	443	50105	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.979430914 CET	443	50105	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.987340927 CET	50106	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:26.987370968 CET	443	50106	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:26.987432957 CET	50106	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.004170895 CET	50106	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.004190922 CET	443	50106	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.004220963 CET	443	50106	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.004532099 CET	50107	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.004563093 CET	443	50107	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.004631042 CET	50107	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.007767916 CET	50107	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.007781029 CET	443	50107	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.007811069 CET	443	50107	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.008560896 CET	50108	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.008594990 CET	443	50108	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.008666039 CET	50108	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.011934996 CET	50108	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.011951923 CET	443	50108	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.011977911 CET	443	50108	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.012336969 CET	50109	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.012376070 CET	443	50109	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.012433052 CET	50109	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.015223026 CET	50109	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.015235901 CET	443	50109	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.015265942 CET	443	50109	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.015635967 CET	50110	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.015667915 CET	443	50110	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.015763044 CET	50110	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.018898010 CET	50110	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.018913984 CET	443	50110	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.018938065 CET	443	50110	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.019289017 CET	50111	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.019304037 CET	443	50111	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.019360065 CET	50111	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.021612883 CET	50111	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.021625996 CET	443	50111	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.021652937 CET	443	50111	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.021899939 CET	50112	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.021912098 CET	443	50112	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.021972895 CET	50112	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.023390055 CET	50112	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.023401976 CET	443	50112	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.023431063 CET	443	50112	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.024013042 CET	50113	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.024030924 CET	443	50113	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.024104118 CET	50113	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.025615931 CET	50113	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.025631905 CET	443	50113	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.025655031 CET	443	50113	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.026376009 CET	50114	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.026391029 CET	443	50114	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.026442051 CET	50114	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.028635025 CET	50114	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.028646946 CET	443	50114	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.028672934 CET	443	50114	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.029395103 CET	50115	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.029413939 CET	443	50115	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.029475927 CET	50115	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.031531096 CET	50115	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.031543970 CET	443	50115	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.031568050 CET	443	50115	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.031797886 CET	50116	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.031821966 CET	443	50116	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.031877995 CET	50116	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.033732891 CET	50116	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.033745050 CET	443	50116	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.033771038 CET	443	50116	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.034048080 CET	50117	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.034082890 CET	443	50117	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.034142017 CET	50117	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.036003113 CET	50117	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.036015987 CET	443	50117	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.036041975 CET	443	50117	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.036339045 CET	50118	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.036355019 CET	443	50118	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.036425114 CET	50118	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.038305998 CET	50118	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.038316965 CET	443	50118	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.038341999 CET	443	50118	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.038605928 CET	50119	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.038618088 CET	443	50119	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.038682938 CET	50119	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.040560007 CET	50119	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.040574074 CET	443	50119	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.040596008 CET	443	50119	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.040860891 CET	50120	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.040884972 CET	443	50120	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.040939093 CET	50120	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.042684078 CET	50120	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.042696953 CET	443	50120	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.042721033 CET	443	50120	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.043335915 CET	50121	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.043354988 CET	443	50121	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.043508053 CET	50121	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.045203924 CET	50121	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.045222998 CET	443	50121	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.045242071 CET	443	50121	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.045705080 CET	50122	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.045715094 CET	443	50122	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.045793056 CET	50122	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.048475981 CET	50122	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.048490047 CET	443	50122	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.048513889 CET	443	50122	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.048888922 CET	50123	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.048901081 CET	443	50123	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.049015999 CET	50123	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.051337004 CET	50123	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.051351070 CET	443	50123	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.051376104 CET	443	50123	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.051713943 CET	50124	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.051738977 CET	443	50124	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.051781893 CET	50124	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.053220034 CET	50124	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.053231955 CET	443	50124	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.053258896 CET	443	50124	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.053566933 CET	50125	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.053601980 CET	443	50125	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.053649902 CET	50125	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.055150032 CET	50125	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.055166006 CET	443	50125	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.055190086 CET	443	50125	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.055459023 CET	50126	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.055469036 CET	443	50126	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.055810928 CET	50126	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.058443069 CET	50126	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.058454037 CET	443	50126	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.058496952 CET	443	50126	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.059015989 CET	50127	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.059031963 CET	443	50127	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.059092045 CET	50127	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.108019114 CET	50127	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.108036041 CET	443	50127	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.108062029 CET	443	50127	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.108469963 CET	50128	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.108491898 CET	443	50128	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.108597040 CET	50128	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.163116932 CET	50128	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.163136959 CET	443	50128	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.163158894 CET	443	50128	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.172306061 CET	50129	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.172334909 CET	443	50129	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.172401905 CET	50129	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.202307940 CET	50129	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.202337980 CET	443	50129	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.202378988 CET	443	50129	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.203238964 CET	50130	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.203274012 CET	443	50130	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.203334093 CET	50130	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.207767963 CET	50130	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.207782030 CET	443	50130	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.207808018 CET	443	50130	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.208313942 CET	50131	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.208338022 CET	443	50131	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.208421946 CET	50131	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.211319923 CET	50131	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.211333036 CET	443	50131	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.211352110 CET	443	50131	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.211986065 CET	50132	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.212037086 CET	443	50132	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.212177038 CET	50132	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.215310097 CET	50132	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.215332031 CET	443	50132	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.215352058 CET	443	50132	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.215795040 CET	50133	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.215840101 CET	443	50133	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.215992928 CET	50133	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.217593908 CET	50133	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.217612028 CET	443	50133	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.217638969 CET	443	50133	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.218027115 CET	50134	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.218060017 CET	443	50134	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.218291044 CET	50134	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.220189095 CET	50134	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.220208883 CET	443	50134	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.220232964 CET	443	50134	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.220630884 CET	50135	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.220643997 CET	443	50135	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.220757961 CET	50135	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.222469091 CET	50135	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.222484112 CET	443	50135	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.222508907 CET	443	50135	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.222951889 CET	50136	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.222996950 CET	443	50136	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.223067045 CET	50136	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.226000071 CET	50136	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.226015091 CET	443	50136	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.226036072 CET	443	50136	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.226473093 CET	50137	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.226515055 CET	443	50137	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.226648092 CET	50137	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.229001045 CET	50137	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.229017019 CET	443	50137	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.229043961 CET	443	50137	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.229389906 CET	50138	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.229403019 CET	443	50138	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.229480028 CET	50138	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.232013941 CET	50138	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.232033014 CET	443	50138	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.232065916 CET	443	50138	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.232446909 CET	50139	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.232502937 CET	443	50139	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.232561111 CET	50139	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.234015942 CET	50139	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.234033108 CET	443	50139	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.234057903 CET	443	50139	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.234522104 CET	50140	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.234571934 CET	443	50140	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.234709978 CET	50140	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.237186909 CET	50140	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.237200975 CET	443	50140	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.237222910 CET	443	50140	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.237478971 CET	50141	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.237524986 CET	443	50141	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.237595081 CET	50141	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.239790916 CET	50141	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.239805937 CET	443	50141	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.239830971 CET	443	50141	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.240194082 CET	50142	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.240205050 CET	443	50142	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.240366936 CET	50142	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.241982937 CET	50142	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.241995096 CET	443	50142	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.242018938 CET	443	50142	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.242407084 CET	50143	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.242422104 CET	443	50143	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.242484093 CET	50143	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.244879961 CET	50143	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.244894981 CET	443	50143	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.244920015 CET	443	50143	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.245198011 CET	50144	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.245223999 CET	443	50144	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.245407104 CET	50144	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.247579098 CET	50144	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.247591019 CET	443	50144	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.247612953 CET	443	50144	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.248001099 CET	50145	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.248016119 CET	443	50145	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.248184919 CET	50145	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.249789000 CET	50145	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.249800920 CET	443	50145	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.249820948 CET	443	50145	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.250215054 CET	50146	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.250224113 CET	443	50146	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.250386000 CET	50146	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.253174067 CET	50146	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.253185987 CET	443	50146	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.253205061 CET	443	50146	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.253460884 CET	50147	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.253468990 CET	443	50147	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.253608942 CET	50147	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.257061958 CET	50147	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.257074118 CET	443	50147	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.257093906 CET	443	50147	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.257657051 CET	50148	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.257678032 CET	443	50148	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.258018017 CET	50148	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.271157026 CET	50148	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.271176100 CET	443	50148	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.271199942 CET	443	50148	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.271488905 CET	50149	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.271539927 CET	443	50149	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.271735907 CET	50149	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.273883104 CET	50149	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.273899078 CET	443	50149	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.273919106 CET	443	50149	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.275784969 CET	50150	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.275813103 CET	443	50150	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.275943995 CET	50150	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.277805090 CET	50150	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.277820110 CET	443	50150	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.277842045 CET	443	50150	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.278188944 CET	50151	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.278208017 CET	443	50151	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.278337955 CET	50151	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.280525923 CET	50151	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.280539036 CET	443	50151	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.280563116 CET	443	50151	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.281040907 CET	50152	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.281089067 CET	443	50152	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.281151056 CET	50152	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.385982990 CET	50152	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.386007071 CET	443	50152	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.386094093 CET	443	50152	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.386920929 CET	50153	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.386956930 CET	443	50153	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.387022018 CET	50153	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.389978886 CET	50153	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.389992952 CET	443	50153	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.390276909 CET	443	50153	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.390703917 CET	50154	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.390742064 CET	443	50154	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.390810013 CET	50154	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.393369913 CET	50154	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.393383026 CET	443	50154	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.393418074 CET	443	50154	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.393678904 CET	50155	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.393692970 CET	443	50155	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.393824100 CET	50155	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.396584034 CET	50155	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.396598101 CET	443	50155	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.396646023 CET	443	50155	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.397161961 CET	50156	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.397209883 CET	443	50156	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.397286892 CET	50156	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.398741961 CET	50156	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.398758888 CET	443	50156	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.398785114 CET	443	50156	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.399173021 CET	50157	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.399199963 CET	443	50157	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.399545908 CET	50157	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.402160883 CET	50157	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.402174950 CET	443	50157	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.402204037 CET	443	50157	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.402718067 CET	50158	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.402743101 CET	443	50158	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.402892113 CET	50158	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.406330109 CET	50158	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.406344891 CET	443	50158	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.406368017 CET	443	50158	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.406625986 CET	50159	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.406637907 CET	443	50159	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.406900883 CET	50159	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.423491955 CET	50159	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.423501015 CET	443	50159	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.423584938 CET	443	50159	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.429728985 CET	50160	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.429757118 CET	443	50160	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.429867029 CET	50160	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.457988024 CET	50160	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.458003044 CET	443	50160	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.458070993 CET	443	50160	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.461879015 CET	50161	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.461918116 CET	443	50161	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.462085962 CET	50161	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.488352060 CET	50161	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.488385916 CET	443	50161	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.488435030 CET	443	50161	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.492053032 CET	50162	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.492091894 CET	443	50162	165.194.123.67	192.168.2.3
Nov 1, 2024 15:56:27.492185116 CET	50162	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.518579960 CET	50162	443	192.168.2.3	165.194.123.67
Nov 1, 2024 15:56:27.518600941 CET	443	50162	165.194.123.67	192.168.2.3

Target ID:	0
Start time:	10:56:24
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\7rtK9LWbTc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7rtK9LWbTc.exe"
Imagebase:	0xbc0000
File size:	80'312 bytes
MD5 hash:	D0930DC6939B931C258795A16B59C2CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:56:24
Start date:	01/11/2024
Path:	C:\ProgramData\Graphics\guifx.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Graphics\guifx.exe" /run
Imagebase:	0xf70000
File size:	80'316 bytes
MD5 hash:	A7D9795D178F27CA2CEBB45293CFE3B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:56:36
Start date:	01/11/2024
Path:	C:\ProgramData\Graphics\guifx.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Graphics\guifx.exe" /run
Imagebase:	0xf70000
File size:	80'316 bytes
MD5 hash:	A7D9795D178F27CA2CEBB45293CFE3B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:56:44
Start date:	01/11/2024
Path:	C:\ProgramData\Graphics\guifx.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Graphics\guifx.exe" /run
Imagebase:	0xf70000
File size:	80'316 bytes
MD5 hash:	A7D9795D178F27CA2CEBB45293CFE3B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:56:55
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\system32\cmd.exe" /c del /q "C:\Users\user\Desktop\7rtK9LWbTc.exe" >> NUL
Imagebase:	0xb80000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:56:55
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.1%
Total number of Nodes:	1838
Total number of Limit Nodes:	5

Executed Functions

Function 00BC2C50 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 75
stringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00BC2C65

Part of subcall function 00BC1CA0: lstrlenA.KERNEL32 ref: 00BC1CAC
Part of subcall function 00BC1CA0: GlobalAlloc.KERNEL32(00000000,00000004), ref: 00BC1CC5

Part of subcall function 00BC2910: StrToIntA.SHLWAPI ref: 00BC2952

StrStrA.SHLWAPI(00000000,/run), ref: 00BC2C92
wsprintfA.USER32 ref: 00BC2CAB

Part of subcall function 00BC2A50: GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 00BC2A71
Part of subcall function 00BC2A50: lstrcpyA.KERNEL32(?,00BCE404), ref: 00BC2A80
Part of subcall function 00BC2A50: CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00BC2AA4
Part of subcall function 00BC2A50: GetLastError.KERNEL32 ref: 00BC2AAA
Part of subcall function 00BC2A50: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00BC2ACB
Part of subcall function 00BC2A50: GetFileSize.KERNEL32(00000000,00000000), ref: 00BC2AE0
Part of subcall function 00BC2A50: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00BC2B03
Part of subcall function 00BC2A50: CloseHandle.KERNELBASE(00000000), ref: 00BC2B0A
Part of subcall function 00BC2A50: lstrcpyA.KERNEL32(00000000,00BCE440), ref: 00BC2B30
Part of subcall function 00BC2A50: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00BC2B3D
Part of subcall function 00BC2A50: lstrcpyA.KERNEL32(?,00BCE468), ref: 00BC2B4F
Part of subcall function 00BC2A50: wsprintfA.USER32 ref: 00BC2B9F

lstrcpyA.KERNEL32(?,l5Sxfak`x|S|v|{jb<=Slbk!jwj), ref: 00BC2CC2
ShellExecuteA.SHELL32(00000000,00000000,00000000,?,00000000,00000000), ref: 00BC2CF1
ExitProcess.KERNEL32 ref: 00BC2CF9
OpenMutexA.KERNEL32(001F0001,00000000,MUTEX394039_4830023), ref: 00BC2D0B
CreateMutexA.KERNEL32(00000000,00000000,MUTEX394039_4830023), ref: 00BC2D1E

Strings

l5Sxfak`x|S|v|{jb<=Slbk!jwj, xrefs: 00BC2CB9
MUTEX394039_4830023, xrefs: 00BC2CFF, 00BC2D17
/c del /q "%s" >> NUL, xrefs: 00BC2CA5
/run, xrefs: 00BC2C8C

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: CreateFilelstrcpy$DirectoryMutexwsprintf$AllocCloseCommandErrorExecuteExitGlobalHandleLastLineModuleNameOpenProcessReadShellSizelstrlen
String ID: /c del /q "%s" >> NUL$/run$MUTEX394039_4830023$l5Sxfak`x|S|v|{jb<=Slbk!jwj
API String ID: 1071610658-845142850
Opcode ID: 3ee7cf31a9e44d92984d7a06836861702e97b1f74c0f435b4035d57089736e44
Instruction ID: e5a04fe687b7e798ad1659f30ad7e04ef693aaa8f3d9a9d86b0e397a196ec608
Opcode Fuzzy Hash: 3ee7cf31a9e44d92984d7a06836861702e97b1f74c0f435b4035d57089736e44
Instruction Fuzzy Hash: 6F216571640208ABD7149BB4DC46FEF7BA8EF18701F0440A9FA0AE7192DE7499458BA5

Function 00BC2A50 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 159
filestringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 00BC2A71
lstrcpyA.KERNEL32(?,00BCE404), ref: 00BC2A80
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00BC2AA4
GetLastError.KERNEL32 ref: 00BC2AAA
CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00BC2ACB
GetFileSize.KERNEL32(00000000,00000000), ref: 00BC2AE0
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00BC2B03
CloseHandle.KERNELBASE(00000000), ref: 00BC2B0A
lstrcpyA.KERNEL32(00000000,00BCE440), ref: 00BC2B30
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00BC2B3D
lstrcpyA.KERNEL32(?,00BCE468), ref: 00BC2B4F
lstrcpyA.KERNEL32(?,00BCE41C), ref: 00BC2B6A
wsprintfA.USER32 ref: 00BC2B9F
CreateFileA.KERNELBASE(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00BC2BC1
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00BC2BE6
GetTickCount.KERNEL32 ref: 00BC2BE8
WriteFile.KERNELBASE(00000000,?,00000004,?,00000000), ref: 00BC2C07
CloseHandle.KERNEL32(00000000), ref: 00BC2C0A
WinExec.KERNEL32(?,00000000), ref: 00BC2C2D

Strings

"%s" /run, xrefs: 00BC2B99

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: File$Createlstrcpy$CloseDirectoryHandleWrite$CountErrorExecLastModuleNameReadSizeTickwsprintf
String ID: "%s" /run
API String ID: 3411283918-4208677260
Opcode ID: f508a42454fade79b73135342a2c8838dce47af8377ddb375b1929e1898fe110
Instruction ID: 4b88a5997743bbc3f77325b5454f0eade4eff460155424d960df4173a038c3f6
Opcode Fuzzy Hash: f508a42454fade79b73135342a2c8838dce47af8377ddb375b1929e1898fe110
Instruction Fuzzy Hash: A9518171A40214EBEB24AB70DC49FEE7BB8EB48700F000299F609E7091DF755E45CBA1

Function 00BC29A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,\`i{xn}jSBfl}`|`i{SXfak`x|SLz}}ja{Yj}|f`aS]za), ref: 00BC29C3
RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 00BC29E7
lstrcpyA.KERNEL32(?,00BCE3F8), ref: 00BC29FB
lstrlenA.KERNEL32 ref: 00BC2A12
RegSetValueExA.KERNELBASE(?,?,00000000,00000001,?,00000000), ref: 00BC2A26
RegCloseKey.KERNELBASE(?,?,00000000), ref: 00BC2A37

Strings

\`i{xn}jSBfl}`|`i{SXfak`x|SLz}}ja{Yj}|f`aS]za, xrefs: 00BC29B8

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: lstrcpy$CloseCreateValuelstrlen
String ID: \`i{xn}jSBfl}`|`i{SXfak`x|SLz}}ja{Yj}|f`aS]za
API String ID: 4056970110-2895997472
Opcode ID: d61720142a5c1b4f528f27c125f6c28b9e7a7c582aeb737e5a21d05e10108b5e
Instruction ID: 6ca221b5b833d846d6457f43b217b32dd72e631e9a1088bfc95703d06bc56033
Opcode Fuzzy Hash: d61720142a5c1b4f528f27c125f6c28b9e7a7c582aeb737e5a21d05e10108b5e
Instruction Fuzzy Hash: CF215E71A04348EBDB15DBB4DC94EEEBFBCEB49700F0040ADE5499B151EA70A944CB60

Function 00BC3469 Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00BC3483

Part of subcall function 00BC2E06: __FF_MSGBANNER.LIBCMT ref: 00BC2E1F
Part of subcall function 00BC2E06: __NMSG_WRITE.LIBCMT ref: 00BC2E26
Part of subcall function 00BC2E06: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,20141104,?,00BC182C,00000288), ref: 00BC2E4B

std::exception::exception.LIBCMT ref: 00BC34B8
std::exception::exception.LIBCMT ref: 00BC34D2
__CxxThrowException@8.LIBCMT ref: 00BC34E3

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 2fd3751708490e5bbfe6d71ecab800fdd3914206e61e74cb4125ec570b260ffa
Instruction ID: 96aea80506b287d56af7101600fa3b1fdae218a19012ddf68ab7f94020baed28
Opcode Fuzzy Hash: 2fd3751708490e5bbfe6d71ecab800fdd3914206e61e74cb4125ec570b260ffa
Instruction Fuzzy Hash: E1F0D171500209AACB18AB54DC12FAEBBE9EB40704F6080EEF44596191DB708A019791

Non-executed Functions

Function 00BC17E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,?), ref: 00BC1812
_malloc.LIBCMT ref: 00BC1827

Part of subcall function 00BC2E06: __FF_MSGBANNER.LIBCMT ref: 00BC2E1F
Part of subcall function 00BC2E06: __NMSG_WRITE.LIBCMT ref: 00BC2E26
Part of subcall function 00BC2E06: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,20141104,?,00BC182C,00000288), ref: 00BC2E4B

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00BC1854
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00BC1876

Strings

PIlp, xrefs: 00BC1846
%2.2X, xrefs: 00BC18E0

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: AdaptersInfo$AllocateComputerHeapName_malloc
String ID: %2.2X$PIlp
API String ID: 2323108929-1622041485
Opcode ID: e7311afbabb611b15dd01e2b20def7c6b2dde9cc2d0638f51a61af9eeead3401
Instruction ID: 6774807c9fbed2ec5b839a5c8eb7434b49d55a10369d14db520d34ee956532cc
Opcode Fuzzy Hash: e7311afbabb611b15dd01e2b20def7c6b2dde9cc2d0638f51a61af9eeead3401
Instruction Fuzzy Hash: BC41E9719041199BCB21DF68DC91FEEB3F8EF56340F0449EDD989A7142DA709E898B90

Function 00BC27E0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00BC2811
Sleep.KERNEL32(00A4CB80), ref: 00BC287B
Sleep.KERNEL32(?), ref: 00BC2890
recv.WS2_32(00000000,?,0000000A,00000000), ref: 00BC28CB
closesocket.WS2_32(00000000), ref: 00BC28D6
Sleep.KERNEL32(0036EE80), ref: 00BC28E3

Strings

`, xrefs: 00BC2896
>9:!>6;!>=<!98, xrefs: 00BC281F, 00BC2826, 00BC284E, 00BC2856
`, xrefs: 00BC2809

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: Sleep$Startupclosesocketrecv
String ID: >9:!>6;!>=<!98$`$`
API String ID: 1594183973-1415459037
Opcode ID: e4aac4cf09a919e2ccb30aafffa22aa8dd73f1a68835178a59a49f7c8800c9e3
Instruction ID: 0997868aceb9d64371c099050eda0ae75c943a6f250c9434dd143ae1cd855a0e
Opcode Fuzzy Hash: e4aac4cf09a919e2ccb30aafffa22aa8dd73f1a68835178a59a49f7c8800c9e3
Instruction Fuzzy Hash: AF31B1B17002049BE724AB25EC95F6B7BD8EF96704F1008ADE84AD7152EE34D905C792

Function 00BC1B60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99memorynetworksleepCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000010,00000000), ref: 00BC1B85
WSAGetLastError.WS2_32(?,?,00000010,00000000), ref: 00BC1B9E
Sleep.KERNEL32(0000000A,?,?,00000010,00000000), ref: 00BC1BBC
GetProcessHeap.KERNEL32(00000008,?,?,?,00000010,00000000), ref: 00BC1BE2
HeapAlloc.KERNEL32(00000000,?,?,00000010,00000000), ref: 00BC1BE5
GetProcessHeap.KERNEL32(00000000), ref: 00BC1C83
HeapFree.KERNEL32(00000000), ref: 00BC1C86

Strings

]Vw, xrefs: 00BC1BE5

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: Heap$Process$AllocErrorFreeLastSleeprecv
String ID: ]Vw
API String ID: 4059495080-1841013464
Opcode ID: b87d3f16defad5c2574c81ceab0f82987835ddab8097ffcc0a08417512f908f2
Instruction ID: 5152b652eac0be6d79bbadbd8454849d6001738b768098101a1655d1b027de10
Opcode Fuzzy Hash: b87d3f16defad5c2574c81ceab0f82987835ddab8097ffcc0a08417512f908f2
Instruction Fuzzy Hash: AF319875A00204DBD710DFA8DC55F6ABBF4FB49350F1449AEE816A7351EB309D01CBA0

Function 00BC19A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97networkstringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00BC19CD

Part of subcall function 00BC1720: _memset.LIBCMT ref: 00BC1742
Part of subcall function 00BC1720: GetVersionExA.KERNEL32(?), ref: 00BC1761
Part of subcall function 00BC1720: GetVersionExA.KERNEL32(0000009C), ref: 00BC1778

Part of subcall function 00BC1570: _memset.LIBCMT ref: 00BC15C4
Part of subcall function 00BC1570: _memset.LIBCMT ref: 00BC1605
Part of subcall function 00BC1570: _memset.LIBCMT ref: 00BC1618
Part of subcall function 00BC1570: lstrcpyA.KERNEL32(?,00BCE2A3), ref: 00BC1626
Part of subcall function 00BC1570: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,?,?,00BCE2A3), ref: 00BC1663
Part of subcall function 00BC1570: _memset.LIBCMT ref: 00BC16B3
Part of subcall function 00BC1570: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000100,?,?,00BCE2A3), ref: 00BC16D5

_sprintf.LIBCMT ref: 00BC1A08
lstrlenA.KERNEL32(?), ref: 00BC1A17
WSAStartup.WS2_32(00000002,?), ref: 00BC1A2D
gethostname.WS2_32(?,000000FF), ref: 00BC1A43
gethostbyname.WS2_32(?), ref: 00BC1A54
WSACleanup.WS2_32 ref: 00BC1A67

Strings

%s/%s, xrefs: 00BC1A02

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: _memset$Version$CleanupNameOpenQueryStartupUserValue_sprintfgethostbynamegethostnamelstrcpylstrlen
String ID: %s/%s
API String ID: 396611607-2758257063
Opcode ID: 00303eb32f23b1115111cebb95565fef420bbaee8e8bd44673a83f5a103f97eb
Instruction ID: 9d913e82a2b712a934f250f99bf195146083137850928b5af49fab6953536e98
Opcode Fuzzy Hash: 00303eb32f23b1115111cebb95565fef420bbaee8e8bd44673a83f5a103f97eb
Instruction Fuzzy Hash: E83195B1E011099FDB24DB64DC95FAAB7B9EB59300F0045DEE50EA7242EB309E45CF54

Function 00BC1720 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BC1742
GetVersionExA.KERNEL32(?), ref: 00BC1761
GetVersionExA.KERNEL32(0000009C), ref: 00BC1778
wsprintfA.USER32 ref: 00BC17C3

Strings

%d.%d, xrefs: 00BC17BD

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: Version$_memsetwsprintf
String ID: %d.%d
API String ID: 3402264179-3954714993
Opcode ID: 15a8f8acca685fc220bfa2dab6e8a0a922b1ba7e1255241ae30e2b0ea22b5690
Instruction ID: 35e2189c4a109bc367e756fba9651f6cdc178df098d574297fced8dfb57c3dc7
Opcode Fuzzy Hash: 15a8f8acca685fc220bfa2dab6e8a0a922b1ba7e1255241ae30e2b0ea22b5690
Instruction Fuzzy Hash: B6114271B412189FDB20DB689C41FBEB7B8EF16300F4405DEE949A7242EA705E45CBA2

Function 00BC306D Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00BC307B

Part of subcall function 00BC2E06: __FF_MSGBANNER.LIBCMT ref: 00BC2E1F
Part of subcall function 00BC2E06: __NMSG_WRITE.LIBCMT ref: 00BC2E26
Part of subcall function 00BC2E06: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,20141104,?,00BC182C,00000288), ref: 00BC2E4B

_free.LIBCMT ref: 00BC308E

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d4aaa2224c682794baa1cbe9d54360d1b7bc171763ee6bca128ce639c15ed112
Instruction ID: a9473a93f7709dba08510f45111a87d7b175bb656d6bdbab6cdcb3e76f675c99
Opcode Fuzzy Hash: d4aaa2224c682794baa1cbe9d54360d1b7bc171763ee6bca128ce639c15ed112
Instruction Fuzzy Hash: 6611E333500311ABCB312B74BC15F5A3BD4EB557A1B6084EEF9C897150DF31CA418694

Function 00BC2D39 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00BC3744
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BC3759
UnhandledExceptionFilter.KERNEL32(00BCC268), ref: 00BC3764
GetCurrentProcess.KERNEL32(C0000409), ref: 00BC3780
TerminateProcess.KERNEL32(00000000), ref: 00BC3787

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 017e8e4112b8babbea2508d68adf9a1a182f539cd3b30f180e2c8484f75848c2
Instruction ID: 9b7c896ee83ffb71cac6e7ed0bda63502d6dc678c2f3f95c42d4a670c23f032f
Opcode Fuzzy Hash: 017e8e4112b8babbea2508d68adf9a1a182f539cd3b30f180e2c8484f75848c2
Instruction Fuzzy Hash: 7D21EBB8916284EFC710EF68F965B48BBB1FB18300F10895BE90887261FFB05984CF19

Function 00BC12A0 Relevance: 4.6, APIs: 3, Instructions: 133networksleepCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00004C5B,00000000), ref: 00BC13F1
WSAGetLastError.WS2_32 ref: 00BC1406
Sleep.KERNEL32(0000000A), ref: 00BC141C

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: ErrorLastSleepsend
String ID:
API String ID: 4076785223-0
Opcode ID: 1c23ac1636526c702adfeb8033ceca71b03153403f8faae7430e51732cbf51c3
Instruction ID: b674cfa77665fe974ede8fbbf15b9755ba39b47165a9f6d39971462bf76dd9ba
Opcode Fuzzy Hash: 1c23ac1636526c702adfeb8033ceca71b03153403f8faae7430e51732cbf51c3
Instruction Fuzzy Hash: DA419132B002288BDB25CF6D9890699FBA9EB9A310F4045EED44AF7642D7345F44CF52

Function 00BC6E85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006E43), ref: 00BC6E8A

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e630e4371161299031ecd1cd38cd796483a5df6f483fb8ef06c9008474dee489
Instruction ID: a837641491b01fc474e74210662d1956f9419a7493da62d2890e7721bdc9cabe
Opcode Fuzzy Hash: e630e4371161299031ecd1cd38cd796483a5df6f483fb8ef06c9008474dee489
Instruction Fuzzy Hash: 9E900264651103CBD61017B19C0FD156BD05A6C6427414895A105D5464EF6041415521

Function 00BC10C0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6724d0094f713dfd851c5757bc941764f039ff211322bff085d9d44cc60ac54a
Instruction ID: e081a6c2c35221a92ff2ebf3d9190fcc7bb5c5d1a6096a6cfab7c56753856eea
Opcode Fuzzy Hash: 6724d0094f713dfd851c5757bc941764f039ff211322bff085d9d44cc60ac54a
Instruction Fuzzy Hash: 0F51D433A61AA506F310867E8C813C577939BCA264F4FC3A9C870AB2D6D57A641BD7D0

Function 00BC1020 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6be091eb61b65efb446137e05583116e77768846b17c6487780c0cf3fd34f7f
Instruction ID: 221380b70bdcbf06a4ed5ffb396d33e71621aea870a9f4a6de4f9757edf4afce
Opcode Fuzzy Hash: e6be091eb61b65efb446137e05583116e77768846b17c6487780c0cf3fd34f7f
Instruction Fuzzy Hash: 5B110632E011294BEF04CABD98900EEFBF5EBDA224F5242AAD841F3342E1701E49C7D0

Function 00BC22A0 Relevance: 89.6, APIs: 39, Strings: 12, Instructions: 375
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00BC22D9
_memset.LIBCMT ref: 00BC22F6
__time64.LIBCMT ref: 00BC2300

Part of subcall function 00BC33C9: GetSystemTimeAsFileTime.KERNEL32(00BC2305,?,?,?,00BC2305,00000000), ref: 00BC33D4
Part of subcall function 00BC33C9: __aulldiv.LIBCMT ref: 00BC33F4

__localtime64.LIBCMT ref: 00BC231B

Part of subcall function 00BC33A2: __localtime64_s.LIBCMT ref: 00BC33B7

_memmove.LIBCMT ref: 00BC2331
lstrcpyA.KERNEL32(?,_]@LJ\\JK/N[), ref: 00BC2348
wsprintfA.USER32 ref: 00BC2394
lstrcmpA.KERNEL32(00000000,00BCE2A3), ref: 00BC23E3
lstrcmpA.KERNEL32(?,+fa{j}ync), ref: 00BC2421
lstrcpyA.KERNEL32(00000000,Fa{j}ync/f|/|j{/{`,?,+fa{j}ync), ref: 00BC2434
StrToIntA.SHLWAPI(?,?,+fa{j}ync), ref: 00BC243A

Strings

K`xac`nk/|zllj||, xrefs: 00BC2519, 00BC26B3
Jwjlz{f`a/|zllj||, xrefs: 00BC2577, 00BC2630
K`xac`nk/infcz}j, xrefs: 00BC24DF, 00BC2692
+k`xac`nkjwjl, xrefs: 00BC24C0
+jwjl, xrefs: 00BC25B6
Jwjlz{f`a/infcz}j, xrefs: 00BC2551, 00BC25ED
Fa{j}ync/f|/|j{/{`, xrefs: 00BC242B
_]@LJ\\JK/N[, xrefs: 00BC233F
%s %d min, xrefs: 00BC249A
+fa{j}ync, xrefs: 00BC241B
CMD:%s %s %d/%d/%d %d:%d:%d, xrefs: 00BC238E
+k`xac`nk, xrefs: 00BC2673

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: Time_memsetlstrcmplstrcpy$FileSystem__aulldiv__localtime64__localtime64_s__time64_memmovewsprintf
String ID: CMD:%s %s %d/%d/%d %d:%d:%d$%s %d min$+fa{j}ync$+jwjl$+k`xac`nk$+k`xac`nkjwjl$Fa{j}ync/f|/|j{/{`$Jwjlz{f`a/infcz}j$Jwjlz{f`a/|zllj||$K`xac`nk/infcz}j$K`xac`nk/|zllj||$_]@LJ\\JK/N[
API String ID: 1549752644-755128454
Opcode ID: 063950031f64a7669b144370cb60e542110a0ee551680eacd5e95116217752f1
Instruction ID: fb068d9ec822258ab85aed3ea1b074ca7a2769c47405c2a8fb0f5ebcde791e0a
Opcode Fuzzy Hash: 063950031f64a7669b144370cb60e542110a0ee551680eacd5e95116217752f1
Instruction Fuzzy Hash: 60D188B1A00248ABD725DB64CC91FEA77FDEF44700F0085EDE54AA7151EE34EE858BA4

Function 00BC59CF Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00BC359C), ref: 00BC59D7
__mtterm.LIBCMT ref: 00BC59E3

Part of subcall function 00BC571C: DecodePointer.KERNEL32(00000005,00BC5B45,?,00BC359C), ref: 00BC572D
Part of subcall function 00BC571C: TlsFree.KERNEL32(00000015,00BC5B45,?,00BC359C), ref: 00BC5747
Part of subcall function 00BC571C: DeleteCriticalSection.KERNEL32(00000000,00000000,775857D0,?,00BC5B45,?,00BC359C), ref: 00BC895C
Part of subcall function 00BC571C: _free.LIBCMT ref: 00BC895F
Part of subcall function 00BC571C: DeleteCriticalSection.KERNEL32(00000015,775857D0,?,00BC5B45,?,00BC359C), ref: 00BC8986

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00BC59F9
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00BC5A06
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00BC5A13
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00BC5A20
TlsAlloc.KERNEL32(?,00BC359C), ref: 00BC5A70
TlsSetValue.KERNEL32(00000000,?,00BC359C), ref: 00BC5A8B
__init_pointers.LIBCMT ref: 00BC5A95
EncodePointer.KERNEL32(?,00BC359C), ref: 00BC5AA6
EncodePointer.KERNEL32(?,00BC359C), ref: 00BC5AB3
EncodePointer.KERNEL32(?,00BC359C), ref: 00BC5AC0
EncodePointer.KERNEL32(?,00BC359C), ref: 00BC5ACD
DecodePointer.KERNEL32(00BC58A0,?,00BC359C), ref: 00BC5AEE
__calloc_crt.LIBCMT ref: 00BC5B03
DecodePointer.KERNEL32(00000000,?,00BC359C), ref: 00BC5B1D
GetCurrentThreadId.KERNEL32 ref: 00BC5B2F

Strings

FlsSetValue, xrefs: 00BC5A08
FlsFree, xrefs: 00BC5A15
KERNEL32.DLL, xrefs: 00BC59D2
FlsAlloc, xrefs: 00BC59F3
FlsGetValue, xrefs: 00BC59FB

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 314a5c1047e3599aa05b039327fd31edc8eb9b61b132357fe6282248337851c7
Instruction ID: d2a802bb24d7246b11462ddd0912c751d1800b71f3104cf71355050bd07c9a73
Opcode Fuzzy Hash: 314a5c1047e3599aa05b039327fd31edc8eb9b61b132357fe6282248337851c7
Instruction Fuzzy Hash: 19311F35903611ABD7316B7AAC79F19BFE4E754360B14095BE414A31A1EF78A8428B50

Function 00BC2000 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 194
sleepprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00BC2031
_memset.LIBCMT ref: 00BC2049
lstrcpyA.KERNEL32(?,L5Sxfak`x|S|v|{jb<=Slbk!jwj), ref: 00BC205D
_sprintf.LIBCMT ref: 00BC2091
CreatePipe.KERNEL32 ref: 00BC20CD
_memset.LIBCMT ref: 00BC20DD
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00BC215D
Sleep.KERNEL32(000001F4), ref: 00BC2196
WaitForSingleObject.KERNEL32(?,0002BF20), ref: 00BC21A4
GetExitCodeProcess.KERNEL32(?,?), ref: 00BC21B8
TerminateProcess.KERNEL32(?,00000000), ref: 00BC21D6
CloseHandle.KERNEL32(?), ref: 00BC21E9
CloseHandle.KERNEL32(?), ref: 00BC21F2
CloseHandle.KERNEL32(?), ref: 00BC21FB
CloseHandle.KERNEL32(?), ref: 00BC220F
CloseHandle.KERNEL32(?), ref: 00BC2218
ReadFile.KERNEL32(?,?,00001FA0,00000001,00000000), ref: 00BC223B
CloseHandle.KERNEL32(?), ref: 00BC2284

Part of subcall function 00BC12A0: send.WS2_32(?,?,00004C5B,00000000), ref: 00BC13F1

Sleep.KERNEL32(0000000A,?,?,?,?,?,?,00040000), ref: 00BC2279

Strings

L5Sxfak`x|S|v|{jb<=Slbk!jwj, xrefs: 00BC2051
D, xrefs: 00BC2119
%s /c %s, xrefs: 00BC208B

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: CloseHandle$Process_memset$CreateSleep$CodeExitFileObjectPipeReadSingleTerminateWait_sprintflstrcpysend
String ID: %s /c %s$D$L5Sxfak`x|S|v|{jb<=Slbk!jwj
API String ID: 2039536558-3632673802
Opcode ID: 74838e153c253f808bebfc7f5a10b2c74083206f1f408ad20967a0b348f53d94
Instruction ID: 216c40132fc5848db7d15a90894a0e760ab43ade11cc667b6acce548f25e707a
Opcode Fuzzy Hash: 74838e153c253f808bebfc7f5a10b2c74083206f1f408ad20967a0b348f53d94
Instruction Fuzzy Hash: 9C7111F5E00218AFDB24DBA4DC80EAEB7B8EB48300F4045EDF609A7150DA745E858F69

Function 00BC1570 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 120
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00BC15C4
_memset.LIBCMT ref: 00BC1605
_memset.LIBCMT ref: 00BC1618
lstrcpyA.KERNEL32(?,00BCE2A3), ref: 00BC1626
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,?,?,00BCE2A3), ref: 00BC1663
_memset.LIBCMT ref: 00BC16B3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000100,?,?,00BCE2A3), ref: 00BC16D5
lstrcatA.KERNEL32(?,?,?,?,00BCE2A3), ref: 00BC16E3
lstrcatA.KERNEL32(?,00BCE2A4,?,?,?,?,00BCE2A3), ref: 00BC16EF
RegCloseKey.ADVAPI32(?,?,?,00BCE2A3), ref: 00BC1707

Strings

L\KYj}|f`a, xrefs: 00BC15C9
_}`kzl{Anbj, xrefs: 00BC1583
\@I[XN]JSBfl}`|`i{SXfak`x|/A[SLz}}ja{Yj}|f`aS, xrefs: 00BC1595

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: _memset$lstrcat$CloseOpenQueryValuelstrcpy
String ID: L\KYj}|f`a$\@I[XN]JSBfl}`|`i{SXfak`x|/A[SLz}}ja{Yj}|f`aS$_}`kzl{Anbj
API String ID: 3930758678-146727092
Opcode ID: 697fa8e724c59d7c0d3fb591fd21e3914d7d20248f77659233ad403515cd87cd
Instruction ID: 64b03da0185bf8ac410cc29daf3450f2635bfbc3a5e7b85e8256add79f86e619
Opcode Fuzzy Hash: 697fa8e724c59d7c0d3fb591fd21e3914d7d20248f77659233ad403515cd87cd
Instruction Fuzzy Hash: 6B41AF71A01318AFEB21CB64DC55F9ABBBDAB49700F1044DDF509AB181DBB09E85CF90

Function 00BC1D9E Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 128
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000100,?), ref: 00BC1DF9
SetCurrentDirectoryA.KERNEL32(?), ref: 00BC1E06
DeleteUrlCacheEntry.WININET ref: 00BC1E0D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00BC1E29
URLOpenBlockingStreamA.URLMON(00000000,?,?,00000000,00000000), ref: 00BC1E45
_memset.LIBCMT ref: 00BC1E6C
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00BC1EBB
_memset.LIBCMT ref: 00BC1ECB
CloseHandle.KERNEL32(00000000), ref: 00BC1EEB

Strings

P6u, xrefs: 00BC1E45
sec.exe, xrefs: 00BC1DE8, 00BC1E22

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: File_memset$BlockingCacheCloseCreateCurrentDeleteDirectoryEntryHandleOpenPathStreamTempWrite
String ID: P6u$sec.exe
API String ID: 1790114914-3636431342
Opcode ID: c1ccba18ab23218a248134a0818f3e78d84d2339d1bac67fb2cf2e985cc8c79a
Instruction ID: 45dbe7c53e3e96e193448f13701ff4f325817902eb1a0e033fb51b2ad2c441a0
Opcode Fuzzy Hash: c1ccba18ab23218a248134a0818f3e78d84d2339d1bac67fb2cf2e985cc8c79a
Instruction Fuzzy Hash: D3316275900118AFD710DB68DC80FEAB7BCEF49704F0485EDEA49E7141DE705E868BA0

Function 00BC1DC0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 106
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000100,?), ref: 00BC1DF9
SetCurrentDirectoryA.KERNEL32(?), ref: 00BC1E06
DeleteUrlCacheEntry.WININET ref: 00BC1E0D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00BC1E29
URLOpenBlockingStreamA.URLMON(00000000,?,?,00000000,00000000), ref: 00BC1E45
_memset.LIBCMT ref: 00BC1E6C
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00BC1EBB
_memset.LIBCMT ref: 00BC1ECB
CloseHandle.KERNEL32(00000000), ref: 00BC1EEB

Strings

P6u, xrefs: 00BC1E45
sec.exe, xrefs: 00BC1DE8, 00BC1E22

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: File_memset$BlockingCacheCloseCreateCurrentDeleteDirectoryEntryHandleOpenPathStreamTempWrite
String ID: P6u$sec.exe
API String ID: 1790114914-3636431342
Opcode ID: 098fea9655005450e9c30ad9fe6c5c1731608b79eff68893df48a6075cfe60d0
Instruction ID: 38efde4bbb249c8be082ea9a3e22509e2751265ec2d82569745fe2a596bedfa5
Opcode Fuzzy Hash: 098fea9655005450e9c30ad9fe6c5c1731608b79eff68893df48a6075cfe60d0
Instruction Fuzzy Hash: AB315072A00118AFD750DB68DC80FEAB7BCEB59704F0485EDEA49E7141DE705E468BA0

Function 00BC1460 Relevance: 12.1, APIs: 8, Instructions: 98networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 00BC1476
WSAGetLastError.WS2_32 ref: 00BC1482
socket.WS2_32(00000002,00000001,00000000), ref: 00BC14A0
htons.WS2_32(?), ref: 00BC14D6
connect.WS2_32(00000000,?,00000010), ref: 00BC14E7
closesocket.WS2_32(00000000), ref: 00BC14F3

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: ErrorLastclosesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 1599336672-0
Opcode ID: 389a3f0ad58a82dca8f5624b475f00d41ba3d57b87ed9f3376a1dc53421e75b9
Instruction ID: dda7d1710fa11f6f76ba2c43087cece819ae3e26b0696088514b1f61d851f8d7
Opcode Fuzzy Hash: 389a3f0ad58a82dca8f5624b475f00d41ba3d57b87ed9f3376a1dc53421e75b9
Instruction Fuzzy Hash: 5E316475A00118AFDB00DFA9DC45FEEBBB8EF5D310F10459AF919E7281DB705A048BA0

Function 00BC5759 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00BCE798,00000008,00BC5861,00000000,00000000,?,?,00BC4727,00BC2E8F,20141104,?,00BC182C,00000288), ref: 00BC576A
__lock.LIBCMT ref: 00BC579E

Part of subcall function 00BC8A6F: __mtinitlocknum.LIBCMT ref: 00BC8A85
Part of subcall function 00BC8A6F: __amsg_exit.LIBCMT ref: 00BC8A91
Part of subcall function 00BC8A6F: EnterCriticalSection.KERNEL32(?,?,?,00BC57A3,0000000D), ref: 00BC8A99

InterlockedIncrement.KERNEL32(00BD01C0), ref: 00BC57AB
__lock.LIBCMT ref: 00BC57BF
___addlocaleref.LIBCMT ref: 00BC57DD

Strings

KERNEL32.DLL, xrefs: 00BC5765

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 5ea04b478a464e07f486e9308973b52195d7e53e14f5afe75af4a94cc91500b6
Instruction ID: 24574e1a37052c5a8935c0dc135541c7c5bdc0ccd7747844ed9aac21bbcd2628
Opcode Fuzzy Hash: 5ea04b478a464e07f486e9308973b52195d7e53e14f5afe75af4a94cc91500b6
Instruction Fuzzy Hash: 93016175445B00DEE720AF69C806B09FBE0EF54320F10498EE49A976A1CFB4AA80CF15

Function 00BC4EDC Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BC4EE8

Part of subcall function 00BC5886: __getptd_noexit.LIBCMT ref: 00BC5889
Part of subcall function 00BC5886: __amsg_exit.LIBCMT ref: 00BC5896

__amsg_exit.LIBCMT ref: 00BC4F08
__lock.LIBCMT ref: 00BC4F18
InterlockedDecrement.KERNEL32(?), ref: 00BC4F35
_free.LIBCMT ref: 00BC4F48
InterlockedIncrement.KERNEL32(00BA1660), ref: 00BC4F60

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 83779f8fb66c292c2ff1a2489f8d9bffb1536ea228a5d36536acbb12cc227a81
Instruction ID: e8c4cc87e9c5cdf429fe2d386cfb50b7c8f5abaa937ab5100641f7a617b508b9
Opcode Fuzzy Hash: 83779f8fb66c292c2ff1a2489f8d9bffb1536ea228a5d36536acbb12cc227a81
Instruction Fuzzy Hash: 8F016D32901A219BE721AB299955F5DB7E0EB14720F0440DEF858A7291DF34AA80CFE5

Function 00BC1F10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72processCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000100,?), ref: 00BC1F31
_memset.LIBCMT ref: 00BC1F43
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00BC1FAD
CloseHandle.KERNEL32(?,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00BC1FD7

Strings

D, xrefs: 00BC1F6D

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: CloseCreateHandlePathProcessTemp_memset
String ID: D
API String ID: 2237058899-2746444292
Opcode ID: e4de81157e87850984a069c41784537982933dfa53fa1e9af8b2d7655287031f
Instruction ID: 4930421867ca5b6ae49797058274e0bc2d15cf4378ce565898aae4ae51081faa
Opcode Fuzzy Hash: e4de81157e87850984a069c41784537982933dfa53fa1e9af8b2d7655287031f
Instruction Fuzzy Hash: 4C214571A4021C9BD764DF64DC42FDAB7F4EB58700F1041EDE60DE7180DA755E858B94

Function 00BC565D Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BC5669

Part of subcall function 00BC5886: __getptd_noexit.LIBCMT ref: 00BC5889
Part of subcall function 00BC5886: __amsg_exit.LIBCMT ref: 00BC5896

__getptd.LIBCMT ref: 00BC5680
__amsg_exit.LIBCMT ref: 00BC568E
__lock.LIBCMT ref: 00BC569E
__updatetlocinfoEx_nolock.LIBCMT ref: 00BC56B2

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 856ba225b426ad2011a234651792d7feb9cf9a94e8d0605ba84ea1ba9f01a454
Instruction ID: 86497d7904cbcee917ea2865a9326ac2054352cea03ae6aa7530a4180b1f482d
Opcode Fuzzy Hash: 856ba225b426ad2011a234651792d7feb9cf9a94e8d0605ba84ea1ba9f01a454
Instruction Fuzzy Hash: 2AF09032956F109BE731BB789902F4D73D0AF10724F9041EEF4546B2D2DF6869808E69

Function 00BC1899 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00BC18E6
_sprintf.LIBCMT ref: 00BC1932
_free.LIBCMT ref: 00BC194B

Strings

%2.2X, xrefs: 00BC18E0

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: _sprintf$_free
String ID: %2.2X
API String ID: 371584759-791839006
Opcode ID: 2fb1c262e504c751909a8d105cca152aceb5dacc4721000c6f01fcd76a3c53e3
Instruction ID: d0e9a4ea35ff3d30ae52f5960f8ef6b90ea6a47ab3ea53f6184fbb7cd36bcfd8
Opcode Fuzzy Hash: 2fb1c262e504c751909a8d105cca152aceb5dacc4721000c6f01fcd76a3c53e3
Instruction Fuzzy Hash: 2D212E319042598BCB21CF68DCA1FEAB3F5EF56344F044DEDD9D9AB102D671DA498B80

Function 00BCA3C9 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00BCA3FD
__isleadbyte_l.LIBCMT ref: 00BCA430
MultiByteToWideChar.KERNEL32(0FF6850C,00000009,?,FFFFF890,00000000,00000000,?,?,?,00BC1937,?,00000000), ref: 00BCA461
MultiByteToWideChar.KERNEL32(0FF6850C,00000009,?,00000001,00000000,00000000,?,?,?,00BC1937,?,00000000), ref: 00BCA4CF

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 082cf1eb45a68f1adc3fe6bafde4b4529658217b5e65b7c618f19a396dbba3a2
Instruction ID: 18a84765b807cf72d1de9d57bf0dd624cc4dbaf813e819b399a56e92487f09e3
Opcode Fuzzy Hash: 082cf1eb45a68f1adc3fe6bafde4b4529658217b5e65b7c618f19a396dbba3a2
Instruction Fuzzy Hash: B931CE30A10289EFDB24DFA4C899FAE3BE4EF01319B1445EDE0609B291D770DD80DB52

Function 00BC2910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

StrToIntA.SHLWAPI ref: 00BC2952
lstrcpyA.KERNEL32(>9:!>6;!>=<!98), ref: 00BC2981

Strings

>9:!>6;!>=<!98, xrefs: 00BC297C

Memory Dump Source

Source File: 00000000.00000002.1714040534.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1714021433.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714076266.0000000000BCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714111337.0000000000BD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714142955.0000000000BD4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_7rtK9LWbTc.jbxd

Similarity

API ID: lstrcpy
String ID: >9:!>6;!>=<!98
API String ID: 3722407311-3495900054
Opcode ID: 9465410e7ed3c800fa80d7c8100a5bf44cfff372409e0209f89eb63013129792
Instruction ID: f6aa292ca476b631470c459ad30045cc4c4c152c80281eef5b10883edbda141d
Opcode Fuzzy Hash: 9465410e7ed3c800fa80d7c8100a5bf44cfff372409e0209f89eb63013129792
Instruction Fuzzy Hash: 5801D8715041565FDB254B28D894FBABBD5EB5A300F5C40FAE5868B212C6B2DC4187E1

Analysis Process: guifx.exePID: 8080, Parent PID: 8056COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1840
Total number of Limit Nodes:	14

Executed Functions

Function 00F72C50 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 75
stringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00F72C65

Part of subcall function 00F71CA0: lstrlenA.KERNEL32 ref: 00F71CAC
Part of subcall function 00F71CA0: GlobalAlloc.KERNEL32(00000000,00000004), ref: 00F71CC5

Part of subcall function 00F72910: StrToIntA.SHLWAPI ref: 00F72952

StrStrA.SHLWAPI(00000000,/run), ref: 00F72C92
wsprintfA.USER32 ref: 00F72CAB

Part of subcall function 00F72A50: GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 00F72A71
Part of subcall function 00F72A50: lstrcpyA.KERNEL32(?,00F7E404), ref: 00F72A80
Part of subcall function 00F72A50: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00F72AA4
Part of subcall function 00F72A50: GetLastError.KERNEL32 ref: 00F72AAA
Part of subcall function 00F72A50: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00F72ACB
Part of subcall function 00F72A50: GetFileSize.KERNEL32(00000000,00000000), ref: 00F72AE0
Part of subcall function 00F72A50: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00F72B03
Part of subcall function 00F72A50: CloseHandle.KERNEL32(00000000), ref: 00F72B0A
Part of subcall function 00F72A50: lstrcpyA.KERNEL32(00000000,00F7E440), ref: 00F72B30
Part of subcall function 00F72A50: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00F72B3D
Part of subcall function 00F72A50: lstrcpyA.KERNEL32(?,00F7E468), ref: 00F72B4F
Part of subcall function 00F72A50: wsprintfA.USER32 ref: 00F72B9F

lstrcpyA.KERNEL32(?,l5Sxfak`x|S|v|{jb<=Slbk!jwj), ref: 00F72CC2
ShellExecuteA.SHELL32(00000000,00000000,00000000,?,00000000,00000000), ref: 00F72CF1
ExitProcess.KERNEL32 ref: 00F72CF9
OpenMutexA.KERNEL32(001F0001,00000000,MUTEX394039_4830023), ref: 00F72D0B
CreateMutexA.KERNELBASE(00000000,00000000,MUTEX394039_4830023), ref: 00F72D1E

Strings

l5Sxfak`x|S|v|{jb<=Slbk!jwj, xrefs: 00F72CB9
/run, xrefs: 00F72C8C
/c del /q "%s" >> NUL, xrefs: 00F72CA5
MUTEX394039_4830023, xrefs: 00F72CFF, 00F72D17

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: CreateFilelstrcpy$DirectoryMutexwsprintf$AllocCloseCommandErrorExecuteExitGlobalHandleLastLineModuleNameOpenProcessReadShellSizelstrlen
String ID: /c del /q "%s" >> NUL$/run$MUTEX394039_4830023$l5Sxfak`x|S|v|{jb<=Slbk!jwj
API String ID: 1071610658-845142850
Opcode ID: e51252fb250bff5a9e9e5085eaf581b65614d518cf0394ffc52df957880ae5a9
Instruction ID: d3090efad07cb62854eb09fdd163d1b9c047774d8afc6bcb673cca4ccb755273
Opcode Fuzzy Hash: e51252fb250bff5a9e9e5085eaf581b65614d518cf0394ffc52df957880ae5a9
Instruction Fuzzy Hash: 3421A771A4020CABD751DBB0DC46FEE7768AF04711F00806BF60DE7182DA749985A7E7

Function 00F717E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,?), ref: 00F71812
_malloc.LIBCMT ref: 00F71827

Part of subcall function 00F72E06: __FF_MSGBANNER.LIBCMT ref: 00F72E1F
Part of subcall function 00F72E06: __NMSG_WRITE.LIBCMT ref: 00F72E26
Part of subcall function 00F72E06: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,20141104,?,00F7182C,00000288), ref: 00F72E4B

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00F71854
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00F71876

Strings

PIlp, xrefs: 00F71846
%2.2X, xrefs: 00F718E0

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: AdaptersInfo$AllocateComputerHeapName_malloc
String ID: %2.2X$PIlp
API String ID: 2323108929-1622041485
Opcode ID: 7817e82a5c08b88c9990408f3f3211af9e1f00c6fed4314e1a8ea0487dedb796
Instruction ID: 53ba42a10a3d0b689a939ab3489a9f2e8bb22af8d5adf69408f8a202b54fcd79
Opcode Fuzzy Hash: 7817e82a5c08b88c9990408f3f3211af9e1f00c6fed4314e1a8ea0487dedb796
Instruction Fuzzy Hash: 5C41F871D001289BCB21DF68DC91BEEB3B9FF55350F0085EAD98D97101DA709E899BD2

Function 00F712A0 Relevance: 4.6, APIs: 3, Instructions: 133
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,?,00004C5B,00000000), ref: 00F713F1
WSAGetLastError.WS2_32 ref: 00F71406
Sleep.KERNEL32(0000000A), ref: 00F7141C

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: ErrorLastSleepsend
String ID:
API String ID: 4076785223-0
Opcode ID: 32c63204bd85214f468d4416bc2f7f323d6ee9aa190cad0b0a4abe5a4c7a830c
Instruction ID: 935425daae9932427db705221c6e46ed79279f6c817d0240f5e74313567a044d
Opcode Fuzzy Hash: 32c63204bd85214f468d4416bc2f7f323d6ee9aa190cad0b0a4abe5a4c7a830c
Instruction Fuzzy Hash: 04418132F002288BDB25CF6D988059AF7A9AB8A320F4145AED44DE7641D7345F88DB52

Function 00F71570 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 120
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F715C4
_memset.LIBCMT ref: 00F71605
_memset.LIBCMT ref: 00F71618
lstrcpyA.KERNEL32(?,00F7E2A3), ref: 00F71626
RegOpenKeyExA.KERNELBASE(80000002,00000000,00000000,00020019,?,?,00F7E2A3), ref: 00F71663
_memset.LIBCMT ref: 00F716B3
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000100,?,?,00F7E2A3), ref: 00F716D5
lstrcatA.KERNEL32(?,?,?,?,00F7E2A3), ref: 00F716E3
lstrcatA.KERNEL32(?,00F7E2A4,?,?,?,?,00F7E2A3), ref: 00F716EF
RegCloseKey.KERNELBASE(?,?,?,00F7E2A3), ref: 00F71707

Strings

L\KYj}|f`a, xrefs: 00F715C9
_}`kzl{Anbj, xrefs: 00F71583
\@I[XN]JSBfl}`|`i{SXfak`x|/A[SLz}}ja{Yj}|f`aS, xrefs: 00F71595

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: _memset$lstrcat$CloseOpenQueryValuelstrcpy
String ID: L\KYj}|f`a$\@I[XN]JSBfl}`|`i{SXfak`x|/A[SLz}}ja{Yj}|f`aS$_}`kzl{Anbj
API String ID: 3930758678-146727092
Opcode ID: 69e0000727053dd2735e98652612dec84e783048eefd7d1b0b4c51d58aef93bc
Instruction ID: ea0afd55cc47194321afb0bc41da11402fe05090caee407471e1c9bb1a3518f9
Opcode Fuzzy Hash: 69e0000727053dd2735e98652612dec84e783048eefd7d1b0b4c51d58aef93bc
Instruction Fuzzy Hash: DC419071E00218ABDB21DB64DC45F9AB7B9AB48704F1080DAF50DA7182DBB05A85EF92

Function 00F727E0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00F72811
Sleep.KERNEL32(00A4CB80), ref: 00F7287B
Sleep.KERNEL32(?), ref: 00F72890
recv.WS2_32(00000000,?,0000000A,00000000), ref: 00F728CB
closesocket.WS2_32(00000000), ref: 00F728D6
Sleep.KERNEL32(0036EE80), ref: 00F728E3

Strings

165.194.123.67, xrefs: 00F7281F, 00F72826, 00F7284E, 00F72856
`, xrefs: 00F72896
`, xrefs: 00F72809

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: Sleep$Startupclosesocketrecv
String ID: 165.194.123.67$`$`
API String ID: 1594183973-349415539
Opcode ID: 00f483b826113eae44ae26eb5fbc399cd235d1415e05b37642c7d99fe23dabf2
Instruction ID: 80d494bfb187175e4384fdfa65ad3bfb1c1812883a6afaec935622e7022463a4
Opcode Fuzzy Hash: 00f483b826113eae44ae26eb5fbc399cd235d1415e05b37642c7d99fe23dabf2
Instruction Fuzzy Hash: 3A3105B2A002049BE3649B34AC44B6B7698FB85314F40842FF94EC6152EB399805E793

Function 00F71B60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99
memorynetworksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32(?,?,00000010,00000000), ref: 00F71B85
WSAGetLastError.WS2_32(?,?,00000010,00000000), ref: 00F71B9E
Sleep.KERNEL32(0000000A,?,?,00000010,00000000), ref: 00F71BBC
GetProcessHeap.KERNEL32(00000008,?,?,?,00000010,00000000), ref: 00F71BE2
HeapAlloc.KERNEL32(00000000,?,?,00000010,00000000), ref: 00F71BE5
GetProcessHeap.KERNEL32(00000000), ref: 00F71C83
HeapFree.KERNEL32(00000000), ref: 00F71C86

Strings

]Vw, xrefs: 00F71BE5

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: Heap$Process$AllocErrorFreeLastSleeprecv
String ID: ]Vw
API String ID: 4059495080-1841013464
Opcode ID: 1b0b4347a0d46f461995b5d4488d16fe44d528292f4aa02e09d68379790a5b64
Instruction ID: c18f1316b7d31f9b84e060e479f0e6d2c32a8bb67c9a9c53f67312b1968b0cd8
Opcode Fuzzy Hash: 1b0b4347a0d46f461995b5d4488d16fe44d528292f4aa02e09d68379790a5b64
Instruction Fuzzy Hash: D5319475E00208DBD710DFA8DC45BEAB7B8FB84360F14855AE80AD7391D734A945EBA2

Function 00F719A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00F719CD

Part of subcall function 00F71720: _memset.LIBCMT ref: 00F71742
Part of subcall function 00F71720: GetVersionExA.KERNEL32(?), ref: 00F71761
Part of subcall function 00F71720: GetVersionExA.KERNEL32(0000009C), ref: 00F71778

Part of subcall function 00F71570: _memset.LIBCMT ref: 00F715C4
Part of subcall function 00F71570: _memset.LIBCMT ref: 00F71605
Part of subcall function 00F71570: _memset.LIBCMT ref: 00F71618
Part of subcall function 00F71570: lstrcpyA.KERNEL32(?,00F7E2A3), ref: 00F71626
Part of subcall function 00F71570: RegOpenKeyExA.KERNELBASE(80000002,00000000,00000000,00020019,?,?,00F7E2A3), ref: 00F71663
Part of subcall function 00F71570: _memset.LIBCMT ref: 00F716B3
Part of subcall function 00F71570: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000100,?,?,00F7E2A3), ref: 00F716D5

_sprintf.LIBCMT ref: 00F71A08
lstrlenA.KERNEL32(?), ref: 00F71A17
WSAStartup.WS2_32(00000002,?), ref: 00F71A2D
gethostname.WS2_32(?,000000FF), ref: 00F71A43
gethostbyname.WS2_32(?), ref: 00F71A54
WSACleanup.WS2_32 ref: 00F71A67

Strings

%s/%s, xrefs: 00F71A02

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: _memset$Version$CleanupNameOpenQueryStartupUserValue_sprintfgethostbynamegethostnamelstrcpylstrlen
String ID: %s/%s
API String ID: 396611607-2758257063
Opcode ID: ef7c670b46912e112677aa1999a007bda571aba83a9f261e3edcb69f0d83f4f3
Instruction ID: 4d9bda5caf7fd4261a879beaf59feed929e726898c7451c0386124b19863e603
Opcode Fuzzy Hash: ef7c670b46912e112677aa1999a007bda571aba83a9f261e3edcb69f0d83f4f3
Instruction Fuzzy Hash: D93163B1E001099FDB24DF64DC85EAA7779FB44740F0081AEE50D97241EA349E89DF95

Function 00F71460 Relevance: 12.1, APIs: 8, Instructions: 98
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostbyname.WS2_32(?), ref: 00F71476
WSAGetLastError.WS2_32 ref: 00F71482
socket.WS2_32(00000002,00000001,00000000), ref: 00F714A0
htons.WS2_32(?), ref: 00F714D6
connect.WS2_32(00000000,?,00000010), ref: 00F714E7
closesocket.WS2_32(00000000), ref: 00F714F3

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: ErrorLastclosesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 1599336672-0
Opcode ID: 77cb1a40392bbbab8ab89de4cba57057c33e35ae5d2d9b541629fb12e292c72f
Instruction ID: 0b2099b7a45efbbf5fe3113729058dbc7c14057304128f6b45aae8b366639968
Opcode Fuzzy Hash: 77cb1a40392bbbab8ab89de4cba57057c33e35ae5d2d9b541629fb12e292c72f
Instruction Fuzzy Hash: 8C318475A00118AFDB10DFA8DC45BEEB7B9EF48310F50416EF909E7281DBB45A049BA2

Non-executed Functions

Function 00F7306D Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00F7307B

Part of subcall function 00F72E06: __FF_MSGBANNER.LIBCMT ref: 00F72E1F
Part of subcall function 00F72E06: __NMSG_WRITE.LIBCMT ref: 00F72E26
Part of subcall function 00F72E06: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,20141104,?,00F7182C,00000288), ref: 00F72E4B

_free.LIBCMT ref: 00F7308E

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 010662604e8ac34203535eb35818bf510524cb21b2279fe830c12e4ef3c9b4f4
Instruction ID: c27587f7a376fc0314681b258e83abb94a9693e218d95c00f9b46c778c05047f
Opcode Fuzzy Hash: 010662604e8ac34203535eb35818bf510524cb21b2279fe830c12e4ef3c9b4f4
Instruction Fuzzy Hash: F3118F32940615BBCB313B74AC057AA37A8BF413B4B20C52BF98C96150DB39DA81B697

Function 00F72D39 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00F73744
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F73759
UnhandledExceptionFilter.KERNEL32(00F7C268), ref: 00F73764
GetCurrentProcess.KERNEL32(C0000409), ref: 00F73780
TerminateProcess.KERNEL32(00000000), ref: 00F73787

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3b9e186f8345d4a93b067845c0f19c660548ebc3619f9ba6a4351a0de3c93113
Instruction ID: eec1e2ed10ed78b247837d0604c8c85ed64442a6c20783c976f45d92fa052d07
Opcode Fuzzy Hash: 3b9e186f8345d4a93b067845c0f19c660548ebc3619f9ba6a4351a0de3c93113
Instruction Fuzzy Hash: C721E2B5804248DFC750DF24ED46AA43BB8FB08310F50821AE60D97260EB7059C6FF52

Function 00F722A0 Relevance: 89.6, APIs: 39, Strings: 12, Instructions: 375
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F722D9
_memset.LIBCMT ref: 00F722F6
__time64.LIBCMT ref: 00F72300

Part of subcall function 00F733C9: GetSystemTimeAsFileTime.KERNEL32(00F72305,?,?,?,00F72305,00000000), ref: 00F733D4
Part of subcall function 00F733C9: __aulldiv.LIBCMT ref: 00F733F4

__localtime64.LIBCMT ref: 00F7231B

Part of subcall function 00F733A2: __localtime64_s.LIBCMT ref: 00F733B7

_memmove.LIBCMT ref: 00F72331
lstrcpyA.KERNEL32(?,_]@LJ\\JK/N[), ref: 00F72348
wsprintfA.USER32 ref: 00F72394
lstrcmpA.KERNEL32(00000000,00F7E2A3), ref: 00F723E3
lstrcmpA.KERNEL32(?,+fa{j}ync), ref: 00F72421
lstrcpyA.KERNEL32(00000000,Fa{j}ync/f|/|j{/{`,?,+fa{j}ync), ref: 00F72434
StrToIntA.SHLWAPI(?,?,+fa{j}ync), ref: 00F7243A

Strings

+k`xac`nkjwjl, xrefs: 00F724C0
_]@LJ\\JK/N[, xrefs: 00F7233F
+fa{j}ync, xrefs: 00F7241B
K`xac`nk/|zllj||, xrefs: 00F72519, 00F726B3
CMD:%s %s %d/%d/%d %d:%d:%d, xrefs: 00F7238E
Jwjlz{f`a/infcz}j, xrefs: 00F72551, 00F725ED
Fa{j}ync/f|/|j{/{`, xrefs: 00F7242B
+jwjl, xrefs: 00F725B6
Jwjlz{f`a/|zllj||, xrefs: 00F72577, 00F72630
K`xac`nk/infcz}j, xrefs: 00F724DF, 00F72692
+k`xac`nk, xrefs: 00F72673
%s %d min, xrefs: 00F7249A

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: Time_memsetlstrcmplstrcpy$FileSystem__aulldiv__localtime64__localtime64_s__time64_memmovewsprintf
String ID: CMD:%s %s %d/%d/%d %d:%d:%d$%s %d min$+fa{j}ync$+jwjl$+k`xac`nk$+k`xac`nkjwjl$Fa{j}ync/f|/|j{/{`$Jwjlz{f`a/infcz}j$Jwjlz{f`a/|zllj||$K`xac`nk/infcz}j$K`xac`nk/|zllj||$_]@LJ\\JK/N[
API String ID: 1549752644-755128454
Opcode ID: b30f2b68a2c7b4208b29b5bdbf4735c1f6f075e4678f21743320af0f65fa438b
Instruction ID: f3f333c8f66c35f3a485f5963ab878d38ffad4d39bfd39481da373dcba113bb1
Opcode Fuzzy Hash: b30f2b68a2c7b4208b29b5bdbf4735c1f6f075e4678f21743320af0f65fa438b
Instruction Fuzzy Hash: CCD18B7190020C9BD764DB74DC41FEA77B9AF48304F00C5ABE54ED7141EA34EA85ABE6

Function 00F759CF Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00F7359C), ref: 00F759D7
__mtterm.LIBCMT ref: 00F759E3

Part of subcall function 00F7571C: DecodePointer.KERNEL32(00000005,00F75B45,?,00F7359C), ref: 00F7572D
Part of subcall function 00F7571C: TlsFree.KERNEL32(00000015,00F75B45,?,00F7359C), ref: 00F75747
Part of subcall function 00F7571C: DeleteCriticalSection.KERNEL32(00000000,00000000,775857D0,?,00F75B45,?,00F7359C), ref: 00F7895C
Part of subcall function 00F7571C: _free.LIBCMT ref: 00F7895F
Part of subcall function 00F7571C: DeleteCriticalSection.KERNEL32(00000015,775857D0,?,00F75B45,?,00F7359C), ref: 00F78986

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00F759F9
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00F75A06
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00F75A13
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00F75A20
TlsAlloc.KERNEL32(?,00F7359C), ref: 00F75A70
TlsSetValue.KERNEL32(00000000,?,00F7359C), ref: 00F75A8B
__init_pointers.LIBCMT ref: 00F75A95
EncodePointer.KERNEL32(?,00F7359C), ref: 00F75AA6
EncodePointer.KERNEL32(?,00F7359C), ref: 00F75AB3
EncodePointer.KERNEL32(?,00F7359C), ref: 00F75AC0
EncodePointer.KERNEL32(?,00F7359C), ref: 00F75ACD
DecodePointer.KERNEL32(00F758A0,?,00F7359C), ref: 00F75AEE
__calloc_crt.LIBCMT ref: 00F75B03
DecodePointer.KERNEL32(00000000,?,00F7359C), ref: 00F75B1D
GetCurrentThreadId.KERNEL32 ref: 00F75B2F

Strings

FlsSetValue, xrefs: 00F75A08
FlsAlloc, xrefs: 00F759F3
FlsFree, xrefs: 00F75A15
KERNEL32.DLL, xrefs: 00F759D2
FlsGetValue, xrefs: 00F759FB

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: a284a763471fd87f0181f3f9e9e18ff53b5d2c5e760292060acb2b42174ba524
Instruction ID: f9d1e36ba616e44d8e127904603bdbdce3bbb48611584313fbe9c95f23e9f577
Opcode Fuzzy Hash: a284a763471fd87f0181f3f9e9e18ff53b5d2c5e760292060acb2b42174ba524
Instruction Fuzzy Hash: 2931B33180270D9ED7206B79AC596F93FA8BB84B70B45462BE418A31B0DBB48443FF43

Function 00F72000 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 194
sleepprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F72031
_memset.LIBCMT ref: 00F72049
lstrcpyA.KERNEL32(?,L5Sxfak`x|S|v|{jb<=Slbk!jwj), ref: 00F7205D
_sprintf.LIBCMT ref: 00F72091
CreatePipe.KERNEL32 ref: 00F720CD
_memset.LIBCMT ref: 00F720DD
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00F7215D
Sleep.KERNEL32(000001F4), ref: 00F72196
WaitForSingleObject.KERNEL32(?,0002BF20), ref: 00F721A4
GetExitCodeProcess.KERNEL32(?,?), ref: 00F721B8
TerminateProcess.KERNEL32(?,00000000), ref: 00F721D6
CloseHandle.KERNEL32(?), ref: 00F721E9
CloseHandle.KERNEL32(?), ref: 00F721F2
CloseHandle.KERNEL32(?), ref: 00F721FB
CloseHandle.KERNEL32(?), ref: 00F7220F
CloseHandle.KERNEL32(?), ref: 00F72218
ReadFile.KERNEL32(?,?,00001FA0,00000001,00000000), ref: 00F7223B
CloseHandle.KERNEL32(?), ref: 00F72284

Part of subcall function 00F712A0: send.WS2_32(?,?,00004C5B,00000000), ref: 00F713F1

Sleep.KERNEL32(0000000A,?,?,?,?,?,?,00040000), ref: 00F72279

Strings

L5Sxfak`x|S|v|{jb<=Slbk!jwj, xrefs: 00F72051
D, xrefs: 00F72119
%s /c %s, xrefs: 00F7208B

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: CloseHandle$Process_memset$CreateSleep$CodeExitFileObjectPipeReadSingleTerminateWait_sprintflstrcpysend
String ID: %s /c %s$D$L5Sxfak`x|S|v|{jb<=Slbk!jwj
API String ID: 2039536558-3632673802
Opcode ID: 4e7548a960c05010b2c98de1afbdfac7a5f6909df5571e6a5a7d689bec6272e4
Instruction ID: e5fefd89f3571774465994413294eec31cbac53d2e9c8580a6b91abd6fbef157
Opcode Fuzzy Hash: 4e7548a960c05010b2c98de1afbdfac7a5f6909df5571e6a5a7d689bec6272e4
Instruction Fuzzy Hash: 307113F1E00218AFDB24DBA5DC809EEB7B8EB48310F4081DAF70DA7151D6745E849F96

Function 00F72A50 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 159
filestringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 00F72A71
lstrcpyA.KERNEL32(?,00F7E404), ref: 00F72A80
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00F72AA4
GetLastError.KERNEL32 ref: 00F72AAA
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00F72ACB
GetFileSize.KERNEL32(00000000,00000000), ref: 00F72AE0
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00F72B03
CloseHandle.KERNEL32(00000000), ref: 00F72B0A
lstrcpyA.KERNEL32(00000000,00F7E440), ref: 00F72B30
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00F72B3D
lstrcpyA.KERNEL32(?,00F7E468), ref: 00F72B4F
lstrcpyA.KERNEL32(?,00F7E41C), ref: 00F72B6A
wsprintfA.USER32 ref: 00F72B9F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00F72BC1
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00F72BE6
GetTickCount.KERNEL32 ref: 00F72BE8
WriteFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00F72C07
CloseHandle.KERNEL32(00000000), ref: 00F72C0A
WinExec.KERNEL32(?,00000000), ref: 00F72C2D

Strings

"%s" /run, xrefs: 00F72B99

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: File$Createlstrcpy$CloseDirectoryHandleWrite$CountErrorExecLastModuleNameReadSizeTickwsprintf
String ID: "%s" /run
API String ID: 3411283918-4208677260
Opcode ID: 57f9cb579983cf4004f7382d339f05c9c4c85e38c62489b875adac574ab126f0
Instruction ID: d0e59cba7c4d89641416743150bf9c87edb486f7e28f14561fcb6461e78dab01
Opcode Fuzzy Hash: 57f9cb579983cf4004f7382d339f05c9c4c85e38c62489b875adac574ab126f0
Instruction Fuzzy Hash: 46518371940218EBEB20EB74DC49FEA7778AB44710F00429AF60DE7091DB755A85DBE3

Function 00F71D9E Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 128filenetworkCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000100,?), ref: 00F71DF9
SetCurrentDirectoryA.KERNEL32(?), ref: 00F71E06
DeleteUrlCacheEntry.WININET ref: 00F71E0D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00F71E29
URLOpenBlockingStreamA.URLMON(00000000,?,?,00000000,00000000), ref: 00F71E45
_memset.LIBCMT ref: 00F71E6C
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00F71EBB
_memset.LIBCMT ref: 00F71ECB
CloseHandle.KERNEL32(00000000), ref: 00F71EEB

Strings

sec.exe, xrefs: 00F71DE8, 00F71E22
P6u, xrefs: 00F71E45

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: File_memset$BlockingCacheCloseCreateCurrentDeleteDirectoryEntryHandleOpenPathStreamTempWrite
String ID: P6u$sec.exe
API String ID: 1790114914-3636431342
Opcode ID: 83b5be733cc22d340bb81287750e7a6542f7dc87fec1ddeeffce17a3f3e00c08
Instruction ID: 84464d013bcddf9c91f65dd414f3e3be90661b76584906d9696bc4601219393b
Opcode Fuzzy Hash: 83b5be733cc22d340bb81287750e7a6542f7dc87fec1ddeeffce17a3f3e00c08
Instruction Fuzzy Hash: 4F317371900118AFD750DB68DC80FEAB7BCFF45714F0481A9EA48D7141DA706E8A9BE2

Function 00F71DC0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 106filenetworkCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000100,?), ref: 00F71DF9
SetCurrentDirectoryA.KERNEL32(?), ref: 00F71E06
DeleteUrlCacheEntry.WININET ref: 00F71E0D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00F71E29
URLOpenBlockingStreamA.URLMON(00000000,?,?,00000000,00000000), ref: 00F71E45
_memset.LIBCMT ref: 00F71E6C
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00F71EBB
_memset.LIBCMT ref: 00F71ECB
CloseHandle.KERNEL32(00000000), ref: 00F71EEB

Strings

sec.exe, xrefs: 00F71DE8, 00F71E22
P6u, xrefs: 00F71E45

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: File_memset$BlockingCacheCloseCreateCurrentDeleteDirectoryEntryHandleOpenPathStreamTempWrite
String ID: P6u$sec.exe
API String ID: 1790114914-3636431342
Opcode ID: 69de87842736d7411650291c36c5ad29657e2f9d01721d04f0ee5643001d2ba6
Instruction ID: f81adaefa761162502c2b619f72a732292cca021914183f6091f5230da331686
Opcode Fuzzy Hash: 69de87842736d7411650291c36c5ad29657e2f9d01721d04f0ee5643001d2ba6
Instruction Fuzzy Hash: 02313275900118AFD760DB58DC80FEAB3BCFB44714F04C1A9AA49E7141DA706E899BE2

Function 00F729A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,\`i{xn}jSBfl}`|`i{SXfak`x|SLz}}ja{Yj}|f`aS]za), ref: 00F729C3
RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 00F729E7
lstrcpyA.KERNEL32(?,00F7E3F8), ref: 00F729FB
lstrlenA.KERNEL32 ref: 00F72A12
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 00F72A26
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F72A37

Strings

\`i{xn}jSBfl}`|`i{SXfak`x|SLz}}ja{Yj}|f`aS]za, xrefs: 00F729B8

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: lstrcpy$CloseCreateValuelstrlen
String ID: \`i{xn}jSBfl}`|`i{SXfak`x|SLz}}ja{Yj}|f`aS]za
API String ID: 4056970110-2895997472
Opcode ID: 8b0dda1814a33f08fab2a820ac33032829dd29f8b93b4dff9f6beb32b76606f3
Instruction ID: 59c19fba008410399a4236d12b3f1f1f32dd33a22e5f1c771b14fa13012b8f58
Opcode Fuzzy Hash: 8b0dda1814a33f08fab2a820ac33032829dd29f8b93b4dff9f6beb32b76606f3
Instruction Fuzzy Hash: 9B215E71E0434CEBEB15DBB4DC849EEBB7DEB45710F00806EE509EB141E6749984EBA2

Function 00F75759 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00F7E798,00000008,00F75861,00000000,00000000,?,?,00F74727,00F72E8F,20141104,?,00F7182C,00000288), ref: 00F7576A
__lock.LIBCMT ref: 00F7579E

Part of subcall function 00F78A6F: __mtinitlocknum.LIBCMT ref: 00F78A85
Part of subcall function 00F78A6F: __amsg_exit.LIBCMT ref: 00F78A91
Part of subcall function 00F78A6F: EnterCriticalSection.KERNEL32(?,?,?,00F757A3,0000000D), ref: 00F78A99

InterlockedIncrement.KERNEL32(00F801C0), ref: 00F757AB
__lock.LIBCMT ref: 00F757BF
___addlocaleref.LIBCMT ref: 00F757DD

Strings

KERNEL32.DLL, xrefs: 00F75765

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 0516eed2500e2c7981571ca41433e31e84efe1262071c9574328a4d7381224f4
Instruction ID: b86249bb5f7534b370dbd1466059284dc9eca67959c10b9a5da1a73fb25b984f
Opcode Fuzzy Hash: 0516eed2500e2c7981571ca41433e31e84efe1262071c9574328a4d7381224f4
Instruction Fuzzy Hash: E1018E71540B05AFE720AF65CC0A749BBE0AF00720F10C90FE49E562A1CBF8AA45EB12

Function 00F74EDC Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00F74EE8

Part of subcall function 00F75886: __getptd_noexit.LIBCMT ref: 00F75889
Part of subcall function 00F75886: __amsg_exit.LIBCMT ref: 00F75896

__amsg_exit.LIBCMT ref: 00F74F08
__lock.LIBCMT ref: 00F74F18
InterlockedDecrement.KERNEL32(?), ref: 00F74F35
_free.LIBCMT ref: 00F74F48
InterlockedIncrement.KERNEL32(00EE1660), ref: 00F74F60

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: d34ef3a7268466d595fa323981d364a4b4d9aaed5030cfd8d105bf7ca202f047
Instruction ID: c5be493c92538ec0675873e0ab348ac03c1a660fae1e59c842de71d3127e7d63
Opcode Fuzzy Hash: d34ef3a7268466d595fa323981d364a4b4d9aaed5030cfd8d105bf7ca202f047
Instruction Fuzzy Hash: 6E018431D01625ABE751AB289D057ED73A1AF04730F548017E41CA7291CB78B981FFE7

Function 00F71F10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72processCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000100,?), ref: 00F71F31
_memset.LIBCMT ref: 00F71F43
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00F71FAD
CloseHandle.KERNEL32(?,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00F71FD7

Strings

D, xrefs: 00F71F6D

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: CloseCreateHandlePathProcessTemp_memset
String ID: D
API String ID: 2237058899-2746444292
Opcode ID: 11b14525ffb8f7c680f190a65108b1329e553a473f018354a5dd1f260e3f1698
Instruction ID: 1eaf6227acf1b9f0891b9a1569bafd023a5ee08a6a03ec14e68531e140cc5923
Opcode Fuzzy Hash: 11b14525ffb8f7c680f190a65108b1329e553a473f018354a5dd1f260e3f1698
Instruction Fuzzy Hash: 9F216571E0021C9BD764DB64DC82BEAB7B4EB48700F1041AAE60DD6180DA755E849BD5

Function 00F71720 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F71742
GetVersionExA.KERNEL32(?), ref: 00F71761
GetVersionExA.KERNEL32(0000009C), ref: 00F71778
wsprintfA.USER32 ref: 00F717C3

Strings

%d.%d, xrefs: 00F717BD

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: Version$_memsetwsprintf
String ID: %d.%d
API String ID: 3402264179-3954714993
Opcode ID: 4f9c573f43b6cda254548f2c5a729c0dc3c8b0b55084c49ec8cf851dd500eebc
Instruction ID: 3ba530e689459c792660bc326423078880204f72483fc50e0ede74cdd3c85e55
Opcode Fuzzy Hash: 4f9c573f43b6cda254548f2c5a729c0dc3c8b0b55084c49ec8cf851dd500eebc
Instruction Fuzzy Hash: 03115E31E002189EDB24DB689C41FBEB778AF06310F4041DAE80D97242DA705E49AB93

Function 00F7565D Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00F75669

Part of subcall function 00F75886: __getptd_noexit.LIBCMT ref: 00F75889
Part of subcall function 00F75886: __amsg_exit.LIBCMT ref: 00F75896

__getptd.LIBCMT ref: 00F75680
__amsg_exit.LIBCMT ref: 00F7568E
__lock.LIBCMT ref: 00F7569E
__updatetlocinfoEx_nolock.LIBCMT ref: 00F756B2

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: db69a9f9af53c3fea394c8c307e73a223bd91d3b6ca6eac1caf2a9cd8a758af1
Instruction ID: 44d5d10db8fadb4eaa22764c03b1a6d8586df9a80b6aa3a99a829398acea5fe0
Opcode Fuzzy Hash: db69a9f9af53c3fea394c8c307e73a223bd91d3b6ca6eac1caf2a9cd8a758af1
Instruction Fuzzy Hash: B0F06D32D45B109BF624BB789D02B5D3290AF00F20FA1C10BE41C6B2D2DBAC6950BA5B

Function 00F71899 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00F718E6
_sprintf.LIBCMT ref: 00F71932
_free.LIBCMT ref: 00F7194B

Strings

%2.2X, xrefs: 00F718E0

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: _sprintf$_free
String ID: %2.2X
API String ID: 371584759-791839006
Opcode ID: 35954b77c69dab807bdaadf6fb6048475a49cc18a19101e652d1c9913de9b3c4
Instruction ID: 7c1c34fec967e78b67c2018a41c7fa54682437659c7a570430e44eb929062b7e
Opcode Fuzzy Hash: 35954b77c69dab807bdaadf6fb6048475a49cc18a19101e652d1c9913de9b3c4
Instruction Fuzzy Hash: 67212C31D002598BCB21CF68DC91BEAB3B5FF85344F04C5AAD9DD9B101D631AA4DDB82

Function 00F7A3C9 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00F7A3FD
__isleadbyte_l.LIBCMT ref: 00F7A430
MultiByteToWideChar.KERNEL32(0FF6850C,00000009,?,FFFFF890,00000000,00000000,?,?,?,00F71937,?,00000000), ref: 00F7A461
MultiByteToWideChar.KERNEL32(0FF6850C,00000009,?,00000001,00000000,00000000,?,?,?,00F71937,?,00000000), ref: 00F7A4CF

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 32d6622d0ccfc5ff28e325d7a5797a17f2ce5798425c91a2edf59789103dcfe2
Instruction ID: 5bee4628b4495690284f1c78aa6bd09781f756a91b8fc9bcba2ae3afbce3b676
Opcode Fuzzy Hash: 32d6622d0ccfc5ff28e325d7a5797a17f2ce5798425c91a2edf59789103dcfe2
Instruction Fuzzy Hash: 3131C431910245EFDB21DF64D888A6E3BA5FF41321B16C56AF4688B1A1D372DD80EB53

Function 00F73469 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00F73483

Part of subcall function 00F72E06: __FF_MSGBANNER.LIBCMT ref: 00F72E1F
Part of subcall function 00F72E06: __NMSG_WRITE.LIBCMT ref: 00F72E26
Part of subcall function 00F72E06: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,20141104,?,00F7182C,00000288), ref: 00F72E4B

std::exception::exception.LIBCMT ref: 00F734B8
std::exception::exception.LIBCMT ref: 00F734D2
__CxxThrowException@8.LIBCMT ref: 00F734E3

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 443c64d21f637dd2d5d92f5013b520702b766df0f54d4e5d5ac1e20399c56829
Instruction ID: 0d2af602b0efba8d6498189cff6d76299a625bfca6d99440efccab40aea248b5
Opcode Fuzzy Hash: 443c64d21f637dd2d5d92f5013b520702b766df0f54d4e5d5ac1e20399c56829
Instruction Fuzzy Hash: 18F08131A00209AACB65EF55DC02EEE36A8AB40314F50C05BF54CD6092DF749A05F7D3

Function 00F72910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

StrToIntA.SHLWAPI ref: 00F72952
lstrcpyA.KERNEL32(165.194.123.67), ref: 00F72981

Strings

165.194.123.67, xrefs: 00F7297C

Memory Dump Source

Source File: 00000001.00000002.2667641986.0000000000F71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000001.00000002.2667620893.0000000000F70000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667665854.0000000000F7C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667688376.0000000000F80000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2667707558.0000000000F84000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f70000_guifx.jbxd

Similarity

API ID: lstrcpy
String ID: 165.194.123.67
API String ID: 3722407311-1981005002
Opcode ID: 8a5d1f822dc4111d96a583a66b6bbee7f7bea4ecf039554b08f086279a4ff30d
Instruction ID: 43991baebaf86433355b6da599f6975fc04b4f68a66ac615e31d8e7de508ab6a
Opcode Fuzzy Hash: 8a5d1f822dc4111d96a583a66b6bbee7f7bea4ecf039554b08f086279a4ff30d
Instruction Fuzzy Hash: 680149719041996BDB654B28CC90BB5B7B4EB09310F4CC067E28E8B202C231DC91B3D3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7rtK9LWbTc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Graphics\guifx.exe

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
7rtK9LWbTc.exe

Function 00BC2C50 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 75
stringsynchronizationCOMMON

Function 00BC2A50 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 159
filestringprocessCOMMON

Function 00BC29A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00BC3469 Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Function 00BC17E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 139
COMMON

Function 00BC27E0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94
sleepnetworkCOMMON

Function 00BC22A0 Relevance: 89.6, APIs: 39, Strings: 12, Instructions: 375
stringCOMMON

Function 00BC59CF Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Function 00BC2000 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 194
sleepprocessfileCOMMON

Function 00BC1570 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 120
registrystringCOMMON

Function 00BC1D9E Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 128
filenetworkCOMMON

Function 00BC1DC0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 106
filenetworkCOMMON